On Wed, 29 Oct 2008 15:46:50 +0000 Paul Evans <paul@xxxxxxxxxxxxx> wrote: > I'm using the "-j ROUTE" target to force a routing decision for this, > but it seems to have the side effect of breaking conntrack. Without -j > ROUTE, the outbound connection appears in the conntrack table, so that > when incoming replies arrive, they pass an ESTABLISHED test, and are > let in. If it needs to -j ROUTE on the way out, then when the reply > comes back, no conntrack entry means it fails ESTABLISHED and gets > dropped. It seems that "-j ROUTE --continue" doesn't help either, it > still goes missing. Actually, this seems to be my mistake. There's an unfortunate side-effect of giving ROUTE the --continue option when called from PREROUTING. The packet exits the PREROUTING chain already with a routing decision made in it before it hits the kernel's routing core which seems to confuse it. It then drops the packet and the conntrack information associated. I've moved the ROUTE calls into POSTROUTING and now it seems to work fine - it routes correctly, it remains in conntrack so the reply passes the ESTABLISHED test. -- Paul Evans <paul@xxxxxxxxxxxxx> Tel: +44 (0) 845 666 7778 Fax: +44 (0) 870 163 4694 http://www.mxtelecom.com
Attachment:
signature.asc
Description: PGP signature
