Hi, sorry, but the reasoning is wrong. UDP has a state in the netfilter connection tracking statetable, but it remains in the NEW state (as long as there isn't any reply traffic). And your rule won't work, because DNAT checks, if the packet you try to change is associated to a connection in the NEW or RELATED state. As the connection is established, DNAT won't work. Christoph On Thu March 19 2009 wrote wlet@xxxxxxx: > Hi, > > I guess this won't work because if you connection is established it will be > stored in a TCP State table which is used for filtering and forwarding. If > you connection already exists it makes no sense to check it against all > rules from the ruleset. > > UDP doesn't have a statetable (cuz it's stateless) and that is the reason > why this works. > > wlet > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- Christoph Paasch École Polytechnique de Louvain Département d'ingénierie informatique www.rollerbulls.be --
Attachment:
signature.asc
Description: This is a digitally signed message part.
