Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #1963

Re: Avoiding DROP in iptables nat.POSTROUTING when SNAT is involved (thanks to: The "nat" table is not intended for filtering, the use of DROP is therefore inhibited)

Show all headers | View raw

Hello,

Andrew Gideon a écrit :
> In upgrading some boxes that are using iptables to SNAT routed traffic, I
> am hitting the:
> 
> 	The "nat" table is not intended for filtering, the use of DROP is
> 	therefore inhibited.
> 
> restriction.  But I'm not sure how to achieve what I want w/o it.
> 
> The ruleset I want to implement prevents outbound traffic with an improper
> source IP - one that doesn't belong to my network.  As I understand it, I
> am *supposed* to do this in the filter table.

Yes.

> That would be fine
> normally, but a check of the source IP cannot reliably be performed in the
> filter table.  The problem is that an invalid source IP as of filter can
> be SNATed into validity by nat.POSTROUTING which runs after
> filter.FORWARD.
> 
> So...how can one reliably filter packets for invalid source IPs without
> checking after nat.POSTROUTING?

You know what SNAT rules you have in nat.POSTROUTING. So you know what
packets in filter.FORWARD will be SNATed or already have a valid source
address. You can create filtering rules which match the same packets as
the SNAT rules but with the ACCEPT target instead of SNAT.

> Or is there some way to do additional
> filtering after nat.POSTROUTING runs?  I am currently under the impression
> that nat.POSTROUTING is the final ruleset to run before a packet departs.

Correct.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Avoiding DROP in iptables nat.POSTROUTING when SNAT is involved (thanks to: The "nat" table is not intended for filtering, the use of DROP is therefore inhibited) Andrew Gideon <c182driver9@gideon.org> - 2013-02-19 00:00 +0000
  Re: Avoiding DROP in iptables nat.POSTROUTING when SNAT is involved (thanks to: The "nat" table is not intended for filtering, the use of DROP is therefore inhibited) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-02-21 09:46 +0100
    Re: Avoiding DROP in iptables nat.POSTROUTING when SNAT is involved (thanks to: The "nat" table is not intended for filtering, the use of DROP is therefore inhibited) Andrew Gideon <c182driver9@gideon.org> - 2013-02-21 20:08 +0000
      Re: Avoiding DROP in iptables nat.POSTROUTING when SNAT is involved (thanks to: The "nat" table is not intended for filtering, the use of DROP is therefore inhibited) Ken Sims <ng12207@kensims.#nospam#.net.invalid> - 2013-02-21 20:54 -0800
      Re: Avoiding DROP in iptables nat.POSTROUTING when SNAT is involved (thanks to: The "nat" table is not intended for filtering, the use of DROP is therefore inhibited) Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2013-02-23 10:26 +0100
        Re: Avoiding DROP in iptables nat.POSTROUTING when SNAT is involved (thanks to: The "nat" table is not intended for filtering, the use of DROP is therefore inhibited) Ken Sims <ng12207@kensims.#nospam#.net.invalid> - 2013-02-23 07:17 -0800

csiph-web