Peter T. Breuer wrote: > So PREROUTING = forwarding! I seeeeee. Not "before any routing takes > place", as one might naively have supposed from the name :). Actually, forwarded was the wrong term. PREROUTING only sees externally originated packets (which includes both forwarded and packets destined for the local machine). It is before any routing. OUTPUT only sees locally originated packets, and is also before any routing too (in theory, implementation differs ;-). External and local packets have different entry points into the stack, so no routing is needed to distinguish between them. >> Because the '-s ! $PROXY_BOX' means the rule will not match packets >> that have proxyhost as the source IP address. > > So telnet's packets would not be redirected as desired. But then there > is no reason why telnet should choose to set src address on outgoing > packets to some machine that it doesn't even know about, is there? Hrmm, I thought this talking about when you were running telnet on the same host as the proxy, so its quite likely it will use the same address as the proxy. >> Use 'iptables -t nat -L -n' and look at the packet counters to see which > > It seems I don't have any. I guess that has to be compiled into the > kernel or modules somewhere. Sorry, typo there.. it was meant to be 'iptables -t nat -L -v' > (I have no idea what number to put for loglevel) without seeing anything You can use the level names instead of numbers (eg info, err) - To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
