On 27 April 2017 at 15:24, Phil Sutter <phil@xxxxxx> wrote: > As reported in netfilter bz#1105, masquerading won't work if there isn't > at least an empty base chain hooked into prerouting. In order to raise > awareness of this problem at the user, complain if a masquerading > statement is added and the table does not contain an appropriate > prerouting chain already. > > To not break user scripts which add the required chain at a later point, > accept the command anyway. > > A better solution would be to create the required chain as a dependency > and drop it again on return path or if the user adds his own one later, > though I doubt the extra effort is feasible here. > > Signed-off-by: Phil Sutter <phil@xxxxxx> > --- > src/evaluate.c | 20 +++++++++++++++++++- > 1 file changed, 19 insertions(+), 1 deletion(-) > This warning will be printed even in rulesets loaded with '-f' which first creates the masq rule an then the other chain. I think is just a matter of documenting *everywhere* that this is the expected behaviour, not a bug. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
