RE: full_cone_nat

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 7 Apr 2009, Jan Engelhardt wrote:

> 
> On Tuesday 2009-04-07 20:16, Jozsef Kadlecsik wrote:
> >On Tue, 7 Apr 2009, Hugo Miguel Mendes wrote:
> >
> >> What I mean with Full Cone NAT is the following:
> >>[...]
> >
> >I answered you on Thu, 2 Apr 2009 when you asked the same question on
> >the netfilter mailing list. The answer hasn't changed since then: 
> >currently there's no way to create full cone NAT.
> >
> >It might be possible to write a new full cone NAT target by creating 
> >wildcard expectations.
> 
> Yeah there is a case where cone nat does not quite work. Assuming there
> are the following mappings:
> 
> origsrc=192.168.17.2 origdst=80.10.20.30 replsrc=134.98.76.54 repldst=80.10.20.30
> origsrc=192.168.17.3 origdst=80.20.30.40 replsrc=134.98.76.54 repldst=80.20.30.40
> 
> Then there is no way to ambiguously map incoming IP_CT_NEW connections
> for 134.98.76.54 to an origsrc.

Yes, full cone NAT can easily break connections or at least is should 
reject the second, overlapping connection for the joy of the user. But if 
someone insists and want to shoot himself in the foot, then by creating 
expectations it might be create full cone NAT.

Best regards,
Jozsef
-
E-mail  : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux