I have a router set for portforwarding - i.e. all incoming packets
on the WAN interface are DNATed to a host on the LAN side
The router is also set to source NAT all packets going out on the WAN
interface.
HOST-----> ROUTER------>INTERNET
LAN WAN
If the router itself sends out a ping on the WAN interface to some
host on the Internet - will netfilter connection tracking ensure that
the ICMP reply is passed back up the router stack and not
port-forwarded back to the HOST.
I am pretty sure that's the way CONNTRACK works but am looking for confirmation
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
