0

I have a strange question regarding NAT using iptables.

When I do SNAT in a postrouting chain in NAT table at the end of the rule should I give -J ACCEPT?

I see counters on the postrouting rule getting incremented but no packet leaving the machine. So does it mean the packet is DROPPED automatically?

Improve this question

2 Answers 2

Reset to default
2

No. There is only one target (-j) per rule. The -j SNAT is exclusive, you can't provide two targets for a rule. If you need to accept the packet, the 'ACCEPT' target should be used in the 'FORWARD' chain of the 'filter' table.

Packets are only dropped if there is a rule to drop them, or if the default policy of the 'FORWARD' chain is 'DROP'. In both case, these counters are updated.

More likely, routing is not enabled or your routing tables are not complete.

To enable routing:

sysctl net.ipv4.ip_forward=1
Improve this answer
3
  • Ok I got you ... but the counter shows that POSTROUTING chain in NAT table has received one packet but the tcpdump doesn't shows any packet leaving from machine. So it means eventhough counter at POSTROUTING is incremented the packet might be dropped ?? I think POSTROUTING chain under nat table is the last chain before the packet leaves out.
    – codingfreak
    Oct 26, 2009 at 13:47
  • What are the policies of the POSTROUTING chain in each table? Also note that due to the operating system architecture, tcpdump may not capture all packets that pass through the interface.
    – Juliano
    Oct 26, 2009 at 15:45
  • I got only one rule in POSTROUTING chain and it is under nat table. This rule does the SNAT. I am using Linux 2.6 kernel and I think tcpdump really works great under this kernel. So chance of tcpdump mistake is really negligable
    – codingfreak
    Oct 27, 2009 at 3:46
0

I think all you need is (eth0 faces out):

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE

and of course

echo 1 > /proc/sys/net/ipv4/ip_forward

Coincidence I was playing with this the other day. The above worked, but articles I read sometimes say "this does not handle all traffic" without further explanation.

Improve this answer
3
  • MASQUERADE is intended to be used for dial-up connections. The recommended form of the later command is sysctl -q net.ipv4.ip_forward=1 .
    – Juliano
    Oct 26, 2009 at 12:47
  • 6
    nah, MASQUERADE is just a lazy form of SNAT were you can't be bothered (or don't know) the external IP address. Nothing wrong with using it.
    – David Pashley
    Oct 26, 2009 at 13:18
  • 1
    MASQUERADE is the correct option to use when the external IP isn't fixed.
    – hookenz
    Nov 28, 2012 at 3:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .