Steve, Thanks for the info. I have been playing around with it and that helped...a little. I played around with the raw table and found that that fixed the issue of traversing the nat table for related connections, but it does not fix the initial problem when acks are not properly dealt with. A more simple example is that ICMP echo requests go out the nat table's output chain, but ICMP echo replies do not. Bill On Wed, Apr 28, 2010 at 3:46 PM, Jan Engelhardt <jengelh@xxxxxxxxxx> wrote: > > On Wednesday 2010-04-28 19:59, Steve Fink wrote: >> > >From the iptables manpage, in the description of the nat table: "This >>table is consulted when a packet that creates a new connection is >>encountered." >> >>I don't know what mechanism makes related packets in an established >>connection follow the translation actions set up by the initial >>packets. There's a magic sheep bit in there somewhere. > > A ct entry with mappings already exists when a related packet shows up, > so there is no need to do a relookup in the table. > -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
