up vote 0 down vote favorite
share [g+] share [fb]

I have a strange question regarding NAT using iptables.

When I do SNAT in a postrouting chain in NAT table at the end of the rule should I give -J ACCEPT?

I see counters on the postrouting rule getting incremented but no packet leaving the machine. So does it mean the packet is DROPPED automatically?

link|improve this question
25% accept rate
feedback

2 Answers

up vote 0 down vote

I think all you need is (eth0 faces out):

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE

and of course

echo 1 > /proc/sys/net/ipv4/ip_forward

Coincidence I was playing with this the other day. The above worked, but articles I read sometimes say "this does not handle all traffic" without further explanation.

link|improve this answer
MASQUERADE is intended to be used for dial-up connections. The recommended form of the later command is sysctl -q net.ipv4.ip_forward=1 . – Juliano Oct 26 '09 at 12:47
3  
nah, MASQUERADE is just a lazy form of SNAT were you can't be bothered (or don't know) the external IP address. Nothing wrong with using it. – David Pashley Oct 26 '09 at 13:18
feedback
up vote 0 down vote

No. There is only one target (-j) per rule. The -j SNAT is exclusive, you can't provide two targets for a rule. If you need to accept the packet, the 'ACCEPT' target should be used in the 'FORWARD' chain of the 'filter' table.

Packets are only dropped if there is a rule to drop them, or if the default policy of the 'FORWARD' chain is 'DROP'. In both case, these counters are updated.

More likely, routing is not enabled or your routing tables are not complete.

To enable routing:

sysctl net.ipv4.ip_forward=1
link|improve this answer
Ok I got you ... but the counter shows that POSTROUTING chain in NAT table has received one packet but the tcpdump doesn't shows any packet leaving from machine. So it means eventhough counter at POSTROUTING is incremented the packet might be dropped ?? I think POSTROUTING chain under nat table is the last chain before the packet leaves out. – codingfreak Oct 26 '09 at 13:47
What are the policies of the POSTROUTING chain in each table? Also note that due to the operating system architecture, tcpdump may not capture all packets that pass through the interface. – Juliano Oct 26 '09 at 15:45
I got only one rule in POSTROUTING chain and it is under nat table. This rule does the SNAT. I am using Linux 2.6 kernel and I think tcpdump really works great under this kernel. So chance of tcpdump mistake is really negligable – codingfreak Oct 27 '09 at 3:46
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.