On Mon, 22 Nov 2004, Christopher Chan wrote:
except that it requires the whole conntrack stuff.
iproute2 nat for full NAT is far less cumbersome.
Technically agreed, except that route NAT for the same reason does not work for protocols not NAT friendly such as FTP, IRC or many other.
Regards Henrik
Could you explain this a bit more?
How would they be broken in a route nat for all protocols to a virtual ip that is sent a box on the inside network?
I can understand when we speak of multiple ftp clients on the inside network going through a nat box that will only map them all to a single external ip. But for one to one full nat mappings?
We also get a bonus in that we can still implement firewalling for one to one mappings via the FORWARD chain in the filter table without having to load conntrack at all.
Christopher. - : send the line "unsubscribe linux-net" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
