lukas@xxxxxxxxxxx wrote:
NAT configuration is simple but some packets are not NATed - on my
public interface packets with source address of my internal (NATed)
network appears and i have no clue what is wrong.
tcpdump -i eth0 -n -vvv |grep 10.10.10
16:30:39.015880 IP (tos 0x0, ttl 127, id 28594, offset 0, flags [DF],
proto: TCP (6), length: 40) 10.10.10.104.3689 > 83.29.48.50.6881: F,
cksum 0x1623 (correct), 3885889894:3885889894(0) ack 3151418643 win 65535
So, I have one workaround. These magic packets are INVALID from point of
state module's view. Therefore this rules
5 200 LOG all -- * ppp0 0.0.0.0/0
0.0.0.0/0 state INVALID LOG flags 2 level 4 prefix `FWD-INVALID'
1 40 REJECT all -- * ppp0 0.0.0.0/0
0.0.0.0/0 state INVALID reject-with icmp-admin-prohibited
where ppp0 is nating device can log and discard this packets.
I'm not sure if any INVALID packet can also be considered as a health
packet. Can you see any false positivities? (I know, that these packets
can occure, when interface with dynamicly assignes address changes its
IP address during established TCP connection, but then we are not able
to repair this state [i.e. close connection on both sides with proper
source IP] either. Therefore we can consider following packets as realy
invalid.)
-- Petr
