Re: Hairpin NAT - possible without packet marking?

From: Robert White <rwhite@pobox.com>
To: Pascal Hambourg <pascal@plouf.fr.eu.org>,
	"netfilter@vger.kernel.org" <netfilter@vger.kernel.org>
Subject: Re: Hairpin NAT - possible without packet marking?
Date: Wed, 5 Jul 2017 05:28:53 +0000	[thread overview]
Message-ID: <950b3507-aa58-d4de-517b-392b03c2b90f@pobox.com> (raw)
In-Reply-To: <2a775b43-8c1d-6b48-cecf-9796b82ec753@plouf.fr.eu.org>

On 07/04/2017 08:53 PM, Pascal Hambourg wrote:
> Le 04/07/2017 à 03:14, Robert White a écrit :
>>
>> I've honestly go no clue why you cant use --in-interface in a
>> POSTROUTING chain.
> 
> Because the POSTROUTING chains also see packets that are generated
> locally and have no input interface.

Wouldn't that just be a mismatch then? Equivalent to a NULL (in the
database usage of the term) where all tests against a missing interface
simply fail.

In the alternate, locally generated packets would seem to come from the
loop/local interface.

I suppose the mismatch logic could be expensive though, I don't know
where this code base's relative efficiencies lie.

Of course this idea may be well-travelled and settled ground.