Dear List: I am trying to solve the problem described at http://lists.netfilter.org/pipermail/netfilter/2006-August/066491.html (How do I make NAT table work reliably?) and for this I'd like to make sure that I understand iptables documentation correctly. 2 simple questions: a) If I have a rule in PREROUTING NAT table -A PREROUTING -s 204.147.182.21 -d 204.147.182.200 -p udp -m udp --sport 8000 --dport 23330 -j DNAT --to-destination 207.5.64.156:25590 where 204.147.182.200 is the IP address of my host and 204.147.182.21 with 207.5.64.156 are two other hosts I am communicating with, then in the POSTROUTING table, should I match this packet by its *original* destination address or by its *new* (altered) destination address. In other words - in POSTROUTING table do I write -A POSTROUTING -d 204.147.182.200 -p udp -m udp --dport 23330 -j SNAT --to-source 204.147.182.200:21226 (matching by the original destination) or -A POSTROUTING -d 207.5.64.156 -p udp -m udp --dport 25590 -j SNAT --to-source 204.147.182.200:21226 (matching by the altered destination) ??? b) If I setup iptables so that all UDP packets coming from 204.147.182.21:8000 to my 204.147.182.200:23330 are redirected to 207.5.64.156:25590 from my 204.147.182.200:21226), then how do these packets register in the conntrack. I can see 2 options: 204.147.182.21:8000 <=> 204.147.182.200:23330 204.147.182.21:8000 <=> 204.147.182.200:21226 Or are there going to be 2 separate conntrack entries? ??? Thank you for your insight Constantine
