Hi, Just a question, if this is intended behavior in NAT/logging with ulog/filter, I know it should be some border case: In test environment, all 10/8 IPs are routed via lo by default to avoid test data from 10/8 net leaving the host. 10.0.0.0/8 dev lo scope link src 10.0.0.1 To allow some connections to reach machines outside, these connections are natted, e.g. Iptables -t nat -A OUTPUT -o lo -d 10.0.0.5 -p tcp -m tcp --dport 80 -j DNAT --to-destination xxx.172:80 This allows to create the connection, but with two side effects: Although the package leaves via eth0, ulog will report OUT=lo: Jan 10 12:06:13 v3lsn1105 iptables:ACCEPT-INFO IN= OUT=lo MAC= SRC=10.xx.xx.3 DST=xxxx.172 LEN=60 TOS=00 PREC=0x00 TTL=64 ID=46425 CE DF PROTO=TCP SPT=48808 DPT=80 SEQ=1237479374 ACK=0 WINDOW=32792 SYN URGP=0 To accept the connection, OUTPUT on lo has to be accepted (using filter rule with -o lo), although package leaves via eth0. Is this expected behavior? Kind regards, Roman DI Roman Fiedler Engineer Safety & Security Department Information Management & eHealth AIT Austrian Institute of Technology GmbH Reininghausstrae 13/1 | 8020 Graz | Austria T +43(0) 50550 2957 | M +43(0) 664 8561599 | F +43(0) 50550 2950 roman.fiedler@xxxxxxxxx | http://www.ait.ac.at/ FN: 115980 i HG Wien | UID: ATU14703506 This email and any attachments thereto, is intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient, please notify the sender by return e-mail or by telephone and delete this message from your system and any printout thereof. Any unauthorized use, reproduction, or dissemination of this message is strictly prohibited. Please note that e-mails are susceptible to change. AIT Austrian Institute of Technology GmbH shall not be liable for the improper or incomplete transmission of the information contained in this communication, nor shall it be liable for any delay in its receipt. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
