For the sake of it, I decided to 'rehearse' my netfilter theory, and ran the following script on .123:
#!/bin/bash
iptables -t filter -I INPUT -j LOG --log-prefix "filter INPUT: " iptables -t filter -I OUTPUT -j LOG --log-prefix "filter OUTPUT: " iptables -t filter -I FORWARD -j LOG --log-prefix "filter FORWARD: "
iptables -t nat -I PREROUTING -j LOG --log-prefix "nat PREROUTING: " iptables -t nat -I OUTPUT -j LOG --log-prefix "nat OUTPUT: " iptables -t nat -I POSTROUTING -j LOG --log-prefix "nat POSTROUTING: "
iptables -t mangle -I PREROUTING -j LOG --log-prefix "mangle PREROUTING: " iptables -t mangle -I INPUT -j LOG --log-prefix "mangle INPUT: " iptables -t mangle -I FORWARD -j LOG --log-prefix "mangle FORWARD: " iptables -t mangle -I OUTPUT -j LOG --log-prefix "mangle OUTPUT: " iptables -t mangle -I POSTROUTING -j LOG --log-prefix "mangle POSTROUTING: "
There is nothing else in the configuration.
Then I did a single 'ping' from one to the other, and vice versa, while logging at 123.
I) Here is the log on 123 in response to a 'ping -c 1 192.168.192.123' issued from 254:
Aug 29 20:07:04 lfs kernel: mangle PREROUTING: IN=eth0 OUT= MAC=00:40:63:ca:ee:3c:00:c0:4f:a6:7c:58:08:00 SRC=192.168.192.254 DST=192.168.192.123 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=4615 SEQ=0
Aug 29 20:07:04 lfs kernel: nat PREROUTING: IN=eth0 OUT= MAC=00:40:63:ca:ee:3c:00:c0:4f:a6:7c:58:08:00 SRC=192.168.192.254 DST=192.168.192.123 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=4615 SEQ=0
Aug 29 20:07:04 lfs kernel: mangle INPUT: IN=eth0 OUT= MAC=00:40:63:ca:ee:3c:00:c0:4f:a6:7c:58:08:00 SRC=192.168.192.254 DST=192.168.192.123 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=4615 SEQ=0
Aug 29 20:07:04 lfs kernel: filter INPUT: IN=eth0 OUT= MAC=00:40:63:ca:ee:3c:00:c0:4f:a6:7c:58:08:00 SRC=192.168.192.254 DST=192.168.192.123 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=4615 SEQ=0
Aug 29 20:07:04 lfs kernel: mangle OUTPUT: IN= OUT=eth0 SRC=192.168.192.123 DST=192.168.192.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=45404 PROTO=ICMP TYPE=0 CODE=0 ID=4615 SEQ=0
Aug 29 20:07:04 lfs kernel: filter OUTPUT: IN= OUT=eth0 SRC=192.168.192.123 DST=192.168.192.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=45404 PROTO=ICMP TYPE=0 CODE=0 ID=4615 SEQ=0
Aug 29 20:07:04 lfs kernel: mangle POSTROUTING: IN= OUT=eth0 SRC=192.168.192.123 DST=192.168.192.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=45404 PROTO=ICMP TYPE=0 CODE=0 ID=4615 SEQ=0
II) Here is the log on 123 in response to a 'ping -c 1 192.168.192.254' issued from 123 itself:
Aug 29 20:07:57 lfs kernel: mangle OUTPUT: IN= OUT=eth0 SRC=192.168.192.123 DST=192.168.192.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=3105 SEQ=0
Aug 29 20:07:57 lfs kernel: nat OUTPUT: IN= OUT=eth0 SRC=192.168.192.123 DST=192.168.192.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=3105 SEQ=0
Aug 29 20:07:57 lfs kernel: filter OUTPUT: IN= OUT=eth0 SRC=192.168.192.123 DST=192.168.192.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=3105 SEQ=0
Aug 29 20:07:57 lfs kernel: mangle POSTROUTING: IN= OUT=eth0 SRC=192.168.192.123 DST=192.168.192.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=3105 SEQ=0
Aug 29 20:07:57 lfs kernel: nat POSTROUTING: IN= OUT=eth0 SRC=192.168.192.123 DST=192.168.192.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=3105 SEQ=0
Aug 29 20:07:57 lfs kernel: mangle PREROUTING: IN=eth0 OUT= MAC=00:40:63:ca:ee:3c:00:c0:4f:a6:7c:58:08:00 SRC=192.168.192.254 DST=192.168.192.123 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=39819 PROTO=ICMP TYPE=0 CODE=0 ID=3105 SEQ=0
Aug 29 20:07:57 lfs kernel: mangle INPUT: IN=eth0 OUT= MAC=00:40:63:ca:ee:3c:00:c0:4f:a6:7c:58:08:00 SRC=192.168.192.254 DST=192.168.192.123 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=39819 PROTO=ICMP TYPE=0 CODE=0 ID=3105 SEQ=0
Aug 29 20:07:57 lfs kernel: filter INPUT: IN=eth0 OUT= MAC=00:40:63:ca:ee:3c:00:c0:4f:a6:7c:58:08:00 SRC=192.168.192.254 DST=192.168.192.123 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=39819 PROTO=ICMP TYPE=0 CODE=0 ID=3105 SEQ=0
To my astonishment, in II) the returning ICMP packets do *not* travel through the NAT PREROUTING chain! In I) however, the incoming packets *do* travel through the NAT PREROUTING chain, as expected.
Fortunately, the behaviour is the same when the test is run on the other machine, so I am the problem, and not iptables (of course).
So why does a returning packet not travel through the NAT PREROUTING chain, whereas a new incoming ping does travel through the NAT PREROUTING chain? Both packets have exactly the same destination, huh?
Z.
