Re: NAT failure with TCP, too

From: Bernardo Innocenti
Date: Sun Oct 22 2006 - 19:41:55 EST




Cristian Grigoriu wrote:
Hi,

I can confirm the same bug you reported here http://www.ussg.iu.edu/hypermail/linux/kernel/0509.2/0279.html
This time it happens with TCP connections originating from the same TCP port (1234) from multiple machines. The SNAT simply doesn't take place and the normal routing occurs.

Kernel is Debian stock 2.6.18-1.

Please let me know if you have find a workaround.

It turned out that the real thing that was triggering the bug
for me was unloading and reloading the ip_nat module without
also reloading ip_conntrack.

The connection tracking tuple would remain in the kernel, visible
in /proc/net/ip_conntrack, but no longer linked to the SNAT rule.
I'd consider this a bug, but very few users will ever be affected.

The workaround for me was to remove my hand-cracted iptables
rules from ppp's ip-up.local and move them to the distro-supplied
iptables firewall instead. The only downside is that I must now
hardcode the destination ip of the SNAT rule because it's too early
to read the interface address of ppp0.

--
// Bernardo Innocenti - Develer S.r.l., R&D dept.
\X/ http://www.develer.com/

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/