On Mon, 12 Nov 2012, Chris Wilson wrote: > I propose that: > > * when the packet matches an existing conntrack rule, and > > * is sent out of an interface that does not list the packet's new (SNAT-to) > source address as one of its IP addresses (i.e. if this were a new > connection, MASQUERADE would not choose this source address), and > > * the --update-source-address flag is set on the MASQUERADE target > > then update the source address on the conntrack rule to the new one. > > That's the same thing that would happen if we deleted the conntrack entry > first: MASQUERADE would choose a new source address and save it in the new > conntrack entry. What do you think about this? - add route change notification event to the net core - add --update-source-address flag to the MASQUERADE target - add a call for such events to the MASQUERADE target, when the flag is enabled The called function then can scan the conntrack table and for every entry which has got the update-source-address flag, can check whether the source IP address should be changed. Those entries are then deleted. Best regards, Joysef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
