From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
To: Alec Matusis <matusis@matusis.com>
Cc: netfilter@vger.kernel.org
Subject: Re: PREROUTING DNAT *inconsistent* behavior
Date: Sat, 18 Dec 2010 01:15:09 +0100 [thread overview]
Message-ID: <4D0BFD0D.2070406@plouf.fr.eu.org> (raw)
In-Reply-To: <06c201cb9e46$b4d13560$1e73a020$@com>
Alec Matusis a écrit :
>> I would have used DNAT instead to make sure
>> the destination address is not changed.
>
> Instead of REDIRECT, we used:
> -A PREROUTING -d server.ip -p tcp --dport 443 -j DNAT --to-destination
> server.ip:5228
> The result is exactly the same.
Do you mean that REDIRECT did not alter the destination address when it
was different from the primary address on eth0 ?
>> What are the other 5% then ?
>
> They are mostly RST packets from various clients:
Sure, RSTs are sent in reply to the bogus packets from the servers.
>> They are probably packets classified in the INVALID state by the
>> connection tracking, which are ignored by the nat table. In a NAT
>> setup,
>> INVALID packets should be dropped because of this. Now the real
>> question
>> is : why are they classified in the INVALID state ?
>
> How can I verify that these packets have been classified as in the INVALID
> state? That may be the key to this problem.
As I suggested, DROP packets in the INVALID state. If you don't see them
any more, you'll know.
next prev parent reply other threads:[~2010-12-18 0:15 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-12-15 4:42 PREROUTING DNAT *inconsistent* behavior Alec Matusis
2010-12-17 22:20 ` Pascal Hambourg
2010-12-18 0:01 ` Alec Matusis
2010-12-18 0:15 ` Pascal Hambourg [this message]
2010-12-18 1:55 ` Alec Matusis
2010-12-20 21:05 ` Pascal Hambourg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D0BFD0D.2070406@plouf.fr.eu.org \
--to=pascal.mail@plouf.fr.eu.org \
--cc=matusis@matusis.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.