On Tue, Dec 13, 2016 at 2:32 PM, /dev/rob0 <rob0@xxxxxxxxx> wrote: > On Tue, Dec 13, 2016 at 01:28:41PM +0000, Tom Hacohen wrote: >> Removing the masquerade line, or changing it to: "oifname wlp1s0 >> masquerade" fixes it, but this is just a workaround that will fail >> in more complex situations. > > ISTM you'd always want to limit a MASQ/SNAT rule by outgoing > interface. I don't get why that was "ugly" (as you said in IRC) or > likely to fail ... well, certainly if using that ruleset where the > default gateway was on some other interface, but so what? Adjust > your rule to suit the situation. > > In more complex situations, such as multiple Internet connections > with policy routing, masquerade is not appropriate. You'd have to > use SNAT. > > If you're doing NAT among RFC 1918 networks, YDIW. Fix the routing. Perhaps "ugly" wasn't the best choice of words, also, as you said, maybe more complex situations will require other more complex configurations so this simple case wouldn't matter anyway. However, let's leave that aside for a moment and consider the test case I provided in my original email. If masquerade is turned on for "lo" it will set the wrong address. Is that not an issue? Or at least an indication something else may be broken there? At the very least, I found this behaviour surprising. -- Tom > -- > http://rob0.nodns4.us/ > Offlist GMX mail is seen only if "/dev/rob0" is in the Subject: > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
