More on conntrack + NAT + mangle/nat tables

[Jörg Harmuth]

Lluís Batlle schrieb:
> I already understood that a packet enters chains in the 'nat' table
> only if it is the _first_ packet of a connection. In that case, we may
> do SNAT in the POSTROUTING chain of the 'nat' table.
> So, the packets arrive to the POSTROUTING chain of the 'mangle' table
> with the source IP address changed (if it's said by the rules of the
> 'nat' table).

No. According to the picture found at

http://iptables-tutorial.frozentux.net/chunkyhtml/traversingoftables.html

packet flow is:

... --> [mangle:POSTROUTING] --> [nat:POSTROUTING]

So, all packets arrive in mangle:POSTROUTING with their source address
unchanged. DNAT - if configured - is already applied to the packet.

If I'm telling old stories now, forget it, but you can modify this
script to fit your needs:

http://iptables-tutorial.frozentux.net/scripts/rc.test-iptables.txt

Following the log (and /proc/net/ip_conntrack) you see the packet flow
in detail. And you see when [S|D]NAT ist applied.

> - I'm learning about the whole netfilter/policy router these days :)
> So I write a lot about that, which sounds strange to me. I hope I'm
> not annoying to the list.

I can only speak for myself - no, you aren't :)

Have a nice time,

Joerg