Lluís Batlle schrieb: > I already understood that a packet enters chains in the 'nat' table > only if it is the _first_ packet of a connection. In that case, we may > do SNAT in the POSTROUTING chain of the 'nat' table. > So, the packets arrive to the POSTROUTING chain of the 'mangle' table > with the source IP address changed (if it's said by the rules of the > 'nat' table). No. According to the picture found at http://iptables-tutorial.frozentux.net/chunkyhtml/traversingoftables.html packet flow is: ... --> [mangle:POSTROUTING] --> [nat:POSTROUTING] So, all packets arrive in mangle:POSTROUTING with their source address unchanged. DNAT - if configured - is already applied to the packet. If I'm telling old stories now, forget it, but you can modify this script to fit your needs: http://iptables-tutorial.frozentux.net/scripts/rc.test-iptables.txt Following the log (and /proc/net/ip_conntrack) you see the packet flow in detail. And you see when [S|D]NAT ist applied. > - I'm learning about the whole netfilter/policy router these days :) > So I write a lot about that, which sounds strange to me. I hope I'm > not annoying to the list. I can only speak for myself - no, you aren't :) Have a nice time, Joerg
