On Wednesday 08 January 2003 07:37 pm, bauer@mit.edu wrote: > Is there a good reason that I am unable to conceive of at the > moment why SNAT is not a valid target in the OUTPUT chain of the > nat table? Turn this around somewhat. Can you present a case where SNAT would need to be done in the nat OUTPUT chain, that could not also be performed in the nat POSTROUTING chain achieving the same effect? Even if you're going to localhost, packets don't go from OUTPUT straight to INPUT. That said, connections originating on the local box addressed to any IP of the box itself do NOT appear in the nat-PREROUTING chain. (If you try to DNAT in PREROUTING it still comes back in INPUT instead of forwarding) Obviously this is a case where DNAT would be required in nat OUTPUT, where it is in fact a valid target. This is the only way to DNAT a connection from the box to itself and send it elsewhere. > Thanks, > Steve j (stealing someone else's apropos sig, I believe Antony Stone's :^) -- Perfection in design is achieved not when there is nothing left to add, but rather when there is nothing left to take away. - Antoine de Saint-Exupery
