On Tuesday 2010-07-20 19:00, Simon Ditner wrote: >I have asterisk running SIP on a router using UDP port 5060 that's >also handling NAT for a network. I'm often doing testing behind NAT >with other SIP devices using UDP port 5060 talking to the internet, >and have run into a problem where NAT is able to claim 5060. nf_nat does not check for local socket existence AFAICS and uses the full 1024:65535 range (when no other options are specified for S/D-NAT) for connections that originated with a srcport of 1024:65535. It cannot easily check for it anyway, due to things like conntrack zones or the user willingly wanting to "go around" local sockets. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
