I probably shouldn't be responding, knowing as little as I do about such things, but I believe this is by design. The nat table only gets a crack at packets that initiate a connection -- as in, do not yet exist in the connection tracking tables. This is true even of UDP packets, because connection tracking heuristically assigns those to connections based on observed IP,port pairs and the traffic pattern. If you want to see those packets in the nat table, you have a number of options: (1) figure out how to do what you want on a connection basis and make sure you have everything set up before any connections are established; (2) install conntrack-tools and do a conntrack -F to flush out tracked connections, so you'll get one packet from each connection through the nat table; or (3) add a rule to the raw table that bypasses connection tracking via the NOTRACK target. >From the iptables manpage, in the description of the nat table: "This table is consulted when a packet that creates a new connection is encountered." I don't know what mechanism makes related packets in an established connection follow the translation actions set up by the initial packets. There's a magic sheep bit in there somewhere. On Wed, Apr 28, 2010 at 10:19 AM, Bill Prochazka <billprozac@xxxxxxxxx> wrote: > So, I have an interesting observation. I am doing some wonky fun > stuff with iptables and have noticed that traffic generated by a host > on an existing connection, is bypassing the NAT table for processing. > I ran netcat listenening on a host and log all traffic on the OUTPUT > and POSTROUTING chains. When I connect from another host, the traffic > is not processed by those chains. However, if I initiate a connection > from that host, the chains are processed appropriately. Is this by > design or is this a bug? The traffic does pass through the mangle > table, just not the NAT table. Anyone ever encounter something like > this? I have verified this on both CentOS 5.4 (2.6.18) and busybox > (2.6.27). > > Bill > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
