SNATed connections show as original ip in /proc/net/tcp
in [Kernel]
|
Prev: [patch v2.6 2/4] IPVS: make friends with nf_conntrack
Next: KVM: MMU: fix forgot reserved bits check in speculative path
From: Noah McNallie on 11 Jul 2010 05:20 just as the topic describes. I'm currently doing SNAT to force some destination tcp ports to be routed through a specific route rather than the default route. To accomplish this I mark thoes packets with iptables, use 'ip' to specify marked packets via the specified route, and then use iptables to change their source address. one problem i've noticed is that in netstat (and hence /proc/net/tcp) the connections are shown as their original source. this causes problems with some things such as identd, because identd won't see the SNATed to ip with that port open. hence it will reply that it has no connection. anyway i can get around this? noah -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: Alexander Clouter on 11 Jul 2010 11:10 Noah McNallie <n0ah(a)n0ah.org> wrote: > > just as the topic describes. > Probably better to post this to netdev? > I'm currently doing SNAT to force some destination tcp ports to be routed > through a specific route rather than the default route. To accomplish this > I mark thoes packets with iptables, use 'ip' to specify marked packets via > the specified route, and then use iptables to change their source address. > SNAT'ing locally sourced traffic? That's pretty nasty. Look into using 'ip rule' and a second routing table. http://lartc.org/howto/lartc.rpdb.html You will still need use iptables/MARK to do L4 (tcp/udp/etc) policy routing though, however now you can dump the ugly SNATing. Cheers -- Alexander Clouter ..sigmonster says: Where do your SOCKS go when you lose them in th' WASHER? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: Noah McNallie on 11 Jul 2010 11:20 On Sun, 11 Jul 2010 10:30:25 -0400, Alexander Clouter <alex(a)digriz.org.uk> wrote: > Noah McNallie <n0ah(a)n0ah.org> wrote: >> >> just as the topic describes. >> > Probably better to post this to netdev? > >> I'm currently doing SNAT to force some destination tcp ports to be >> routed >> through a specific route rather than the default route. To accomplish >> this >> I mark thoes packets with iptables, use 'ip' to specify marked packets >> via >> the specified route, and then use iptables to change their source >> address. >> > SNAT'ing locally sourced traffic? That's pretty nasty. > > Look into using 'ip rule' and a second routing table. > > http://lartc.org/howto/lartc.rpdb.html > > You will still need use iptables/MARK to do L4 (tcp/udp/etc) policy > routing though, however now you can dump the ugly SNATing. > > Cheers > ok i'll stick it there i must have missed that browsing mailing lists last night... uhh as far as ip rule i am using that, that's how i match the packets with the firewall mark that need to go out a specific interface and to a specific route... i don't believe ip rule has any option to match packets based on destination port and change their source address and route them out any specific interface, or i'd be doing that all along as that would be much better. noah -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: Alexander Clouter on 11 Jul 2010 14:10
Noah McNallie <n0ah(a)n0ah.org> wrote: > >> Look into using 'ip rule' and a second routing table. >> >> http://lartc.org/howto/lartc.rpdb.html >> >> You will still need use iptables/MARK to do L4 (tcp/udp/etc) policy >> routing though, however now you can dump the ugly SNATing. > > ok i'll stick it there i must have missed that browsing mailing lists last > night... uhh as far as ip rule i am using that, that's how i match the > packets with the firewall mark that need to go out a specific interface > and to a specific route... i don't believe ip rule has any option to match > packets based on destination port and change their source address and > route them out any specific interface, or i'd be doing that all along as > that would be much better. > I read your original post as saying were using iptables and the SNAT action, I am suggesting you use 'ip rule' to say "if x/tcp or y/udp using routing table 'alternative'". Might be easier if you actually put here the ip/iptables rules you are actually using? In the alternative routing table you can say to use a different source IP and/or alternative default gateway address (using something like 'ip route ... src ... via ... dev'). As I mentioned before, as 'ip rule' only knows about IP addresses (and not tcp/udp/etc port numbers and what not) you will need to use iptables MARK action and the fwmark in 'ip rule' to get the L4 policy based routing you want. By using a second routing table (as described in the LARTC link), you can stop using the 'iptables -j SNAT' I think you are using. Then, hopefully all your netstat output for locally sourced traffic will be correct. Cheers -- Alexander Clouter ..sigmonster says: You will be married within a year, and divorced within two. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |