Re: SNATed connections show as original ip in /proc/net/tcp
From: Noah McNallie
Date: Sun Jul 11 2010 - 11:12:12 EST
On Sun, 11 Jul 2010 10:30:25 -0400, Alexander Clouter <alex@xxxxxxxxxxxxx>
wrote:
Noah McNallie <n0ah@xxxxxxxx> wrote:
just as the topic describes.
Probably better to post this to netdev?
I'm currently doing SNAT to force some destination tcp ports to be
routed
through a specific route rather than the default route. To accomplish
this
I mark thoes packets with iptables, use 'ip' to specify marked packets
via
the specified route, and then use iptables to change their source
address.
SNAT'ing locally sourced traffic? That's pretty nasty.
Look into using 'ip rule' and a second routing table.
http://lartc.org/howto/lartc.rpdb.html
You will still need use iptables/MARK to do L4 (tcp/udp/etc) policy
routing though, however now you can dump the ugly SNATing.
Cheers
ok i'll stick it there i must have missed that browsing mailing lists last
night... uhh as far as ip rule i am using that, that's how i match the
packets with the firewall mark that need to go out a specific interface
and to a specific route... i don't believe ip rule has any option to match
packets based on destination port and change their source address and
route them out any specific interface, or i'd be doing that all along as
that would be much better.
noah
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/