LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 04-09-2010, 07:55 AM   #1
Ygrex
Member
 
Registered: Nov 2004
Location: Russia (St.Petersburg)
Distribution: Debian
Posts: 666

Rep: Reputation: 68
Question iptables SNAT misses some packets


Hi,

I've noticed few packets behind the NAT, which should be NATed, but they are not.

In other words. My NAT:
Code:
iptables -A POSTROUTING -s 192.168.1.0/24 \! -d 192.168.0.0/16 -j SNAT --to-source 22.33.44.55
eth0 with 22.33.44.55 - Internet gw
eth1 with 192.168.1.254 - Intranet gw

Then:
Code:
tcpdump -i eth0 -ne 'net 192.168.1.0/24'
And it sometimes outputs something. It all works generally, but distinct packets for some reason passes SNAT w/o altering src. These packets definetely reach the next gateway, I see them on the other side as well.

Thanks in advance,

Igor
 
Old 04-09-2010, 11:01 AM   #2
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
-s 192.168.1.0/24 \! -d 192.168.0.0/16 -j SNAT --to-source 22.33.44.55

Can you describe it in words, please. Especially about "\!" part.

Thanks
 
Old 04-09-2010, 02:07 PM   #3
Ygrex
Member
 
Registered: Nov 2004
Location: Russia (St.Petersburg)
Distribution: Debian
Posts: 666

Original Poster
Rep: Reputation: 68
Quote:
Originally Posted by nimnull22 View Post
-s 192.168.1.0/24 \! -d 192.168.0.0/16 -j SNAT --to-source 22.33.44.55

Can you describe it in words, please. Especially about "\!" part.
it must do (and definetely does) NAT for any host from 192.168.1.0/24 to 22.33.44.55; meantime I do not want to NAT a local traffic; no other rules in NAT table

then, simetimes I see on eth0 smth like:
Quote:
IP 192.168.1.4.50226 > 74.125.77.19.443: F 253979169:253979169(0) ack 3081852170 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: R 1:1(0) ack 1 win 0
 
Old 04-09-2010, 02:25 PM   #4
Ygrex
Member
 
Registered: Nov 2004
Location: Russia (St.Petersburg)
Distribution: Debian
Posts: 666

Original Poster
Rep: Reputation: 68
I've tried to flush NetFilter's connections with 'conntrack -F' and there's some effect: number of such packets (with a FIN flag) considerably increased
 
Old 04-09-2010, 02:38 PM   #5
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
Try like this:

iptables -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 22.33.44.55
 
Old 04-09-2010, 03:23 PM   #6
Ygrex
Member
 
Registered: Nov 2004
Location: Russia (St.Petersburg)
Distribution: Debian
Posts: 666

Original Poster
Rep: Reputation: 68
how could a subnet exception cause such a problem (= security caveat)? the only reason is an iptables' bug, I think; there's must be something else more probable
 
Old 04-09-2010, 03:43 PM   #7
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
How would you act as a driver, if three passengers in your car start to ask you to do different things at ones?

You have to give to iptables as simple and effective rules as possible, and please, read about iptables - believe me it works just fine. This is perfect driver, problems with passengers.
 
Old 04-09-2010, 04:06 PM   #8
Ygrex
Member
 
Registered: Nov 2004
Location: Russia (St.Petersburg)
Distribution: Debian
Posts: 666

Original Poster
Rep: Reputation: 68
netfilter is a complex system; why do you suspicious a good working rule in a nat table?
 
Old 04-09-2010, 04:15 PM   #9
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
Because when you said "NAT table" in reality you talk about SNAT, which needs specific conditions for proper functionality. Your condition was confusing and was not single-valued.
 
Old 04-09-2010, 04:29 PM   #10
Ygrex
Member
 
Registered: Nov 2004
Location: Russia (St.Petersburg)
Distribution: Debian
Posts: 666

Original Poster
Rep: Reputation: 68
I still do not understand your idea, why a TCP like "192.168.1.4.50226 > 74.125.77.19.443" can pass POSTROUTING in NAT without any altering, but should be captured if I remove a local traffic exclusion?
 
Old 04-09-2010, 04:43 PM   #11
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
Do you still have that problem?
 
Old 04-10-2010, 03:27 PM   #12
Ygrex
Member
 
Registered: Nov 2004
Location: Russia (St.Petersburg)
Distribution: Debian
Posts: 666

Original Poster
Rep: Reputation: 68
Quote:
Originally Posted by nimnull22 View Post
Do you still have that problem?
yes, I've described it in the first post; I'll post here a solution when find one
 
Old 04-10-2010, 03:34 PM   #13
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
Did you try what I suggest?
 
Old 04-12-2010, 05:39 AM   #14
Ygrex
Member
 
Registered: Nov 2004
Location: Russia (St.Petersburg)
Distribution: Debian
Posts: 666

Original Poster
Rep: Reputation: 68
Quote:
Originally Posted by nimnull22 View Post
Did you try what I suggest?
no

The solution:
Code:
iptables -A FORWARD -s 192.168.0.0/16 \! -d 192.168.0.0/16 -m state --state INVALID -j DROP
I'm not sure, but it seems INVALID connections pass NAT without altering

Last edited by Ygrex; 04-12-2010 at 06:41 AM.
 
Old 04-16-2010, 07:51 AM   #15
cola
Senior Member
 
Registered: Sep 2007
Location: Dhaka,Bangladesh
Distribution: Debian
Posts: 1,019

Rep: Reputation: 63
Quote:
Originally Posted by Ygrex View Post
no

The solution:
Code:
iptables -A FORWARD -s 192.168.0.0/16 \! -d 192.168.0.0/16 -m state --state INVALID -j DROP
I'm not sure, but it seems INVALID connections pass NAT without altering
Is the problem solved?
 
0 members found this post helpful.
  


Reply

Tags
iptables, nat, snat, tcpdump


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Enable SNAT with IPTABLES on FC5 fayax Linux - Networking 5 08-03-2007 04:31 PM
IPTables snat help DukeLeto Linux - Networking 1 10-01-2006 12:49 PM
iptables port80 forward and snat pthegreat Linux - Security 5 01-16-2006 10:03 PM
IPtables: SNAT & Aliasing kegwell Linux - Security 2 01-05-2005 09:55 PM
IPTables: DNAT, SNAT and Masquerading tarballed Linux - Security 3 12-10-2004 04:45 PM


All times are GMT -5. The time now is 10:12 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration