Hello, Vigneswaran R a écrit : > On 05/15/2014 07:12 PM, Ethy H. Brito wrote: >> Hi All >> >> I have this setup in which there are lots of static IPs "SNATed" IP-Phones >> behind a Linux machine. A very simply NAT machine. Just one SNAT rule for the >> phones' network. >> >> At every Linux machine reboot, some of those phones, randomly, simply does not >> register at some outside-nat SIP server. >> >> Investigating with tcpdump I can see, at the external interface, "not snated" >> packets from those not registered phones. Packets from the other phones are >> correctly "snatted". > > May be, some phones are trying to register via ESTABLISHED connections > which not getting SNATed. So, the registration fails. Not ESTABLISHED (that would require return traffic, but existing (NEW). If a phone sends a SIP packet before the SNAT rule is active, then the whole SIP flow, including further packets, will not be SNATed until the related conntrack entry expires. Expiration never happens if the sending period is shorter than the UDP conntrack expiration delay. If you don't want this to happen, just DROP all FORWARDed traffic until the SNAT rule is active. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
