To ping a host in a different network, I have configured a dual homed[ two network interfaces] linux system to act as NAT router.
[snip]
But I'am unable to understand the fact that the ICMP replies are reaching the host in NETWORK A which had generated the requests, without adding a DNAT rule for the same.
How is this possible, does iptables automatically redirect ICMP replies ?
And How to avoid the same.
Yes, you specify that you want to do SNAT or DNAT in one direction, and Netfilter will handle returning packets (and only returning packets!) correctly.
BTW, what would be the purpuse of preventing this??? If the returned packet wasn't handled automatically, neither the firewall nor the host in network A would be able to handle it. Firewall wouldn't be able to handle it since original ping request hasn't originated from it. Host in network A (if packet managed to miraculasly reach it despite of incorrect destination IP address) wouldn't be able to handle it (other than forwarding it back to the firewall, if kernel configuration permits) since reply would have destination IP address of the firewall in the headers. So really no point in avoiding this behaviour.
-- Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
