[RFC PATCH 0/1] netfilter: nat: restore default DNAT behavior

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



We have noticed what appears to be a regression from v4.4 in the DNAT
port selection logic in nf_nat_core.c.  Specifically, we're expecting an
iptables command like

    iptables -t nat -A PREROUTING -p tcp -d -m tcp --dport 32000:32010
    -j DNAT --to-destination

to DNAT traffic sent to to  We use the range on the LAN side to handle
tuple collisions that might occur with a single port specified via

The behavior we're seeing currently, however, is the behavior we'd
expect if we were passing --random to iptables (but we are not passing
--random): the DNAT'd port is random within the range.

Through my naive debugging, I've arrived at this RFC patch and have
included it mostly to illustrate the behavior our userspace is expecting
with the above iptables command.  The hope is that I can be educated
with what other folks expect the behavior to be, or what I can change in
our iptables command to get the behavior we're expecting.

Thanks so much for your time,


[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux