Re: Re-routing packets via netfilter (ip_rt_bug)

Herbert Xu wrote:

Here is another reason why these packets should go through FORWARD.
They were generated in response to packets in INPUT/FORWARD/OUTPUT.
The original packet has not undergone SNAT in any of these cases.

However, if we feed the response packet through LOCAL_OUT it will
be subject to DNAT.  This creates a NAT asymmetry and we may end
up with the wrong destination address.

By pushing it through FORWARD it will only undergo SNAT which is
correct since the original packet would have undergone DNAT.

This is only a problem since the recent NAT changes, but I agree
that we should fix it by moving these packets to FORWARD.

Regards
Patrick
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

---

• References:
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Patrick McHardy <[email protected]>
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Herbert Xu <[email protected]>
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Patrick McHardy <[email protected]>
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Herbert Xu <[email protected]>
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Patrick McHardy <[email protected]>
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Herbert Xu <[email protected]>
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Patrick McHardy <[email protected]>
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Herbert Xu <[email protected]>
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Jozsef Kadlecsik <[email protected]>
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Herbert Xu <[email protected]>
  • Re: Re-routing packets via netfilter (ip_rt_bug)
    • From: Herbert Xu <[email protected]>

• Prev by Date: Re: [PATCH] private mounts
• Next by Date: Re: [BUG] 2.6.12-rc3: unkillable java process in TASK_RUNNING on AMD64
• Previous by thread: Re: Re-routing packets via netfilter (ip_rt_bug)
• Next by thread: RE: Re-routing packets via netfilter (ip_rt_bug)
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]