On Fri, Apr 28, 2017 at 09:01:44AM +0200, Arturo Borrero Gonzalez wrote:
> On 27 April 2017 at 15:24, Phil Sutter <phil@xxxxxx> wrote:
> > As reported in netfilter bz#1105, masquerading won't work if there isn't
> > at least an empty base chain hooked into prerouting. In order to raise
> > awareness of this problem at the user, complain if a masquerading
> > statement is added and the table does not contain an appropriate
> > prerouting chain already.
> >
> > To not break user scripts which add the required chain at a later point,
> > accept the command anyway.
> >
> > A better solution would be to create the required chain as a dependency
> > and drop it again on return path or if the user adds his own one later,
> > though I doubt the extra effort is feasible here.
> >
> > Signed-off-by: Phil Sutter <phil@xxxxxx>
> > ---
> > src/evaluate.c | 20 +++++++++++++++++++-
> > 1 file changed, 19 insertions(+), 1 deletion(-)
> >
>
> This warning will be printed even in rulesets loaded with '-f'
> which first creates the masq rule an then the other chain.
Hmm. I tested it with the following config and it works fine:
| table ip nat {
| chain post {
| type nat hook postrouting priority 0; policy accept;
| oifname "veth2" masquerade
| }
|
| chain pre {
| type nat hook prerouting priority 0; policy accept;
| }
| }
OK, with a config consisting of several 'add' commands, it indeed warns.
> I think is just a matter of documenting *everywhere* that this is the
> expected behaviour, not a bug.
Yeah, I should indeed have done that first, also because masquerade
statement is not documented at all yet.
Thanks, Phil
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
