1. 25 Jun, 2010 1 commit
  2. 22 Jun, 2010 3 commits
  3. 17 Jun, 2010 1 commit
    • Patrick McHardy's avatar
      netfilter: nf_nat: support user-specified SNAT rules in LOCAL_IN · c68cd6cc
      Patrick McHardy authored
      2.6.34 introduced 'conntrack zones' to deal with cases where packets
      from multiple identical networks are handled by conntrack/NAT. Packets
      are looped through veth devices, during which they are NATed to private
      addresses, after which they can continue normally through the stack
      and possibly have NAT rules applied a second time.
      
      This works well, but is needlessly complicated for cases where only
      a single SNAT/DNAT mapping needs to be applied to these packets. In that
      case, all that needs to be done is to assign each network to a seperate
      zone and perform NAT as usual. However this doesn't work for packets
      destined for the machine performing NAT itself since its corrently not
      possible to configure SNAT mappings for the LOCAL_IN chain.
      
      This patch adds a new INPUT chain to the NAT table and changes the
      targets performing SNAT to be usable in that chain.
      
      Example usage with two identical networks (192.168.0.0/24) on eth0/eth1:
      
      iptables -t raw -A PREROUTING -i eth0 -j CT --zone 1
      iptables -t raw -A PREROUTING -i eth0 -j MARK --set-mark 1
      iptables -t raw -A PREROUTING -i eth1 -j CT --zone 2
      iptabels -t raw -A PREROUTING -i eth1 -j MARK --set-mark 2
      
      iptables -t nat -A INPUT       -m mark --mark 1 -j NETMAP --to 10.0.0.0/24
      iptables -t nat -A POSTROUTING -m mark --mark 1 -j NETMAP --to 10.0.0.0/24
      iptables -t nat -A INPUT       -m mark --mark 2 -j NETMAP --to 10.0.1.0/24
      iptables -t nat -A POSTROUTING -m mark --mark 2 -j NETMAP --to 10.0.1.0/24
      
      iptables -t raw -A PREROUTING -d 10.0.0.0/24 -j CT --zone 1
      iptables -t raw -A OUTPUT     -d 10.0.0.0/24 -j CT --zone 1
      iptables -t raw -A PREROUTING -d 10.0.1.0/24 -j CT --zone 2
      iptables -t raw -A OUTPUT     -d 10.0.1.0/24 -j CT --zone 2
      
      iptables -t nat -A PREROUTING -d 10.0.0.0/24 -j NETMAP --to 192.168.0.0/24
      iptables -t nat -A OUTPUT     -d 10.0.0.0/24 -j NETMAP --to 192.168.0.0/24
      iptables -t nat -A PREROUTING -d 10.0.1.0/24 -j NETMAP --to 192.168.0.0/24
      iptables -t nat -A OUTPUT     -d 10.0.1.0/24 -j NETMAP --to 192.168.0.0/24
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      c68cd6cc
  4. 15 Jun, 2010 10 commits
  5. 14 Jun, 2010 9 commits
  6. 13 Jun, 2010 2 commits
  7. 12 Jun, 2010 9 commits
  8. 11 Jun, 2010 5 commits