[Bug 72] New: ICMPs sent by REJECT are not getting SNAT'd

[bugzilla-daemon@netfilter.org]

https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=72

           Summary: ICMPs sent by REJECT are not getting SNAT'd
           Product: netfilter/iptables
           Version: linux-2.4.x
          Platform: i386
        OS/Version: RedHat Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: NAT
        AssignedTo: laforge@netfilter.org
        ReportedBy: netfilter@taner.net
                CC: netfilter-buglog@lists.netfilter.org


Linux 2.4.20-8 (RedHat 9.0)
 iptables v1.2.7a

This is the email I sent to the netfilter user list....

Hi, I have a somewhat convoluted setup, so I'll try to describe it.

DSL provider gave me a /29 for my machines
        (say, 200.1.1.0/29)
DSL provider also supplied a /30 to go between DSL modem and the DSLAM.
        (say, 201.1.1.0/30 - irrelevant here, really)
I am using a random /30 to go between the DSL modem and my firewall
        (say, 10.1.1.0/30)

Here is the visual:

    [ISP]
      |
      | [201.1.1.0/30 - irrelevant]
      |
+------------+
| DSL router |
+------------+ = 10.1.1.2
      |
      | [10.1.1.0/30]
      |
+------------------+ eth1 = 10.1.1.1
| Firewall machine |
+------------------+ eth0 = 200.1.1.1
      |
      | [200.1.1.0/29]
      |
   [INSIDE]


For right now, my firewall rules are basiclaly nothing - I pass everything
thru the firewall machine.

I soon realised that since I'm using a non-routed address for the "outside"
interface of the firewall, I run into issues trying to initiate any
connection from the fw machine, so I added:

 iptables -t nat -A POSTROUTING -o eth1 -s 10.1.1.1 -j SNAT --to-source 200.1.1.1

This works for 99% of the traffic sourced on the firewall machine, it seems.

One thing it DOES NOT work for, is the ICMP (and probably RST - didn't try)
packets that are generated by the REJECT target.  These get sourced from the
unroutable address, and since my ISP wisely filters things like that, the
ICMP never makes it to the sender.

Am I doing something wrong, or is this a bug?

Thanks,

        -Taner



------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.