Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm still reading the iptables manual page and other documents and digging around questions and their answers.

This is the problem which arises. When we setup the NAT we use a POSTROUTING rule such as this:

iptables -A POSTROUTING -t nat -j MASQUERADE -o eth0 

It seems when a packet hits this chain then an internal host needs to initialize some connection with the internet right? Incoming traffic will route through the same path without hitting the chain? Am I right on this?

share|improve this question

migrated from serverfault.com Jun 5 '13 at 13:18

This question came from our site for professional system and network administrators.

1 Answer 1

The POSTROUTING chain is checked for all packets which leave the system, even the locally generated ones (they leave out PREROUTING and use OUTPUT instead).

The rule is limited to traffic which is outgoing via eth0. "Incoming" is every traffic being routed (if you related this to POSTROUTING). You probably mean traffic from the Internet (eth0). Usually traffic which comes in on eth0 will not leave the system via eth0.

POSTROUTING affects outgoing traffic only (and only the first packet of a connection). If replies arrive on eth0 then they are recognized as part of the SNAT connection and their destination address (and port) are automatically translated to their original values (those overwritten by the MASQUERADE target).

share|improve this answer
    
Yes eth0 is the internet connection. So incoming connections to the eth0 will not hit that POSTROUTING chain in NAT table but it will be considered as SNAT and will be translated to their original values? –  sandun dhammika Jun 5 '13 at 14:53
    
I'm asking this question because, we didn't explicitly didn't mention such this. It's happening implicitly. Am I right on that. –  sandun dhammika Jun 5 '13 at 14:54
    
@sandundhammika For each incoming packet the connection tracking checks whether it is part of a known connection. If it belongs to a known connection and the outgoing parts of this connection are masqueraded then the automatic translation takes place. This does not affect incoming packets which create a new connection. –  Hauke Laging Jun 5 '13 at 14:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.