How to set how long iptables remembers?

khaan · 03-09-2010, 07:53 AM

Hi,

I've got a box with 2 interfaces, with IP1 = 192.168.100.1 and IP2 = 10.1.1.1 respectively on them.
I've got an iptables rule that looks like:

Code:

iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -d 10.0.0.0/8 -p udp -j SNAT --to-source 10.1.1.1 --random

If I get 2 consecutive packets from the same address and port from 192.168.100.0/24, they get SNAT-ed and come out of the same port on 10.1.1.1. If then I get another packet from the same address and port 10 minutes later, then it gets SNAT-ed, but comes out of a different port on 10.1.1.1.

My question is: how can I set the time delay I would like iptables to remember its incoming address/port to outgoing port mappings?

smoker · 03-09-2010, 08:10 AM

I don't think you can if you're using random.
You can use
--average percent

Quote:

random
This module randomly matches a certain percentage of all packets.

--average percent
Matches the given percentage. If omitted, a probability of 50%
is set.

khaan · 03-09-2010, 10:09 AM

smoker: I don't think we're talking about the same thing. I am using the --random argument to the SNAT target.

Code:

       --random
              If  option --random is used then port mapping will be randomized
              (kernel >= 2.6.21).

smoker · 03-09-2010, 10:17 AM

man iptables

khaan · 03-09-2010, 10:56 AM

Quote:

Originally Posted by smoker

man iptables

errmmm... yeees, that's where

Code:

       --random
              If  option --random is used then port mapping will be randomized
              (kernel >= 2.6.21).

comes from.

smoker · 03-09-2010, 11:32 AM

percentage of time ?

You can't set the time ,but you can set how many times on average a packet gets matched by the random rule.

sarin · 03-09-2010, 11:48 AM

Not too sure, but have you tried state?

iptables -t nat -A POSTROUTING -m state --state ESTABLISHED,RELATED -s 10.0.0.0/24 -p udp -j SNAT --to 10.1.0.100

Btw, Working on SIP?

mpier · 03-09-2010, 01:23 PM

Hi,
/proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout, /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_stream.

khaan · 03-10-2010, 06:14 AM

Quote:

Originally Posted by mpier

Hi,
/proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout, /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_stream.

Thanks, that's exactly what I was looking for.