Jozsef Kadlecsik a écrit : > On Wed, 24 Nov 2010, Dave Sparks wrote: > >> I noticed a problem that happens on all our firewalls (various 2.6 and >> Shorewall version) where sometimes the final packet in a conversation >> will not be natted. What happens is the src IP is not rewritten, and >> the rfc1918 src address is sent to the internet. [...] > I guess the packet in question has got INVALID state: those are not > NAT-ed (being INVALID, cannot be). So add a rule which drops INVALID > packets. I agree. In a NAT setup, packets with the INVALID state should be dropped because NAT relies on connection tracking. The trace shows that the last packet is a FIN segment retransmitted multiple times because it was not ACK'ed by the other side. It should not be the last packet of the connection, the other side should send an ACK segment. I guess that after a 60-second delay the connection tracking entry expired and this is why the FIN packet got the INVALID state. The root cause is the missing ACK. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
