I already understood that a packet enters chains in the 'nat' table only if it is the _first_ packet of a connection. In that case, we may do SNAT in the POSTROUTING chain of the 'nat' table. So, the packets arrive to the POSTROUTING chain of the 'mangle' table with the source IP address changed (if it's said by the rules of the 'nat' table). BUT, for the rest of the packets (not the first ones) of a connection, packets enter the POSTROUTING chain of the 'mangle' table _without_ a changed source IP address. Is this the expected behaviour of netfilter/conntrack? To me, it's quite strange. - I'm learning about the whole netfilter/policy router these days :) So I write a lot about that, which sounds strange to me. I hope I'm not annoying to the list. Thanks a lot. - Lluís
