On Fri, 11 Apr 2003, Taner Halicioglu wrote: > > > I soon realised that since I'm using a non-routed address for the "outside" > > > interface of the firewall, I run into issues trying to initiate any > > > connection from the fw machine, so I added: > > > > > > iptables -t nat -A POSTROUTING -o eth1 -s 10.1.1.1 -j SNAT --to-source 200.1.1.1 > > > > > > This works for 99% of the traffic sourced on the firewall machine, it seems. > > > > > > One thing it DOES NOT work for, is the ICMP (and probably RST - didn't try) > > > packets that are generated by the REJECT target. These get sourced from the > > > unroutable address, and since my ISP wisely filters things like that, the > > > ICMP never makes it to the sender. > > > > If I understand your setup and the problem correctly, you mean that you > > REJECT requests targeted to the firewall itself and the reject packets > > contain the private address of the firewall as source address. > > > > But how packets can reach the private address of your firewall? > > No, the problem is that when the firewall machine REJECTs any packets in a > FORWARD chain (ie, anything I am blocking that is destined to the network > behind it), the source IP of the ICMP UNREACH (or evn the RST packets) is > that of the *outside* interface - the unroutable address. It seems the > POSTROUTING is not performed on the ICMPs that are created by the actual > host. If this is a problem of the forwarded packets, then it has nothing to do with the connections initiated from/targeted to the firewall itself. But if the packets created by the REJECT target contain the address of the firewall, then the packet they are rejecting was targeted to the firewall. Which one is true? Both cannot be. Show me the tcpdump of both the packets rejected and the reject packets generated. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary
