I am using ip tables in conjunction with net-filter queue in order to alter packets programmatically.

Im using iptables rules over ubuntu lab with 2 NICs eth0 to the internet and eth1 to the LAN I have used the well known iptables rules for NATing with masquerading on eth0 Sudo iptables --table nat --append POSTROUTING -o eth0 -j MASQUERADE sudo iptables -append FORWARD -i eth1 -j ACCEPT. sudo iptables -t mangle -A PREROUTING -j NFQUEUE --queue-num 0 Sudo iptables -t mangle -A OUTPUT -j NFQUEUE. these 4 rules are used to help me capture packets inside my program and modify packets or drop what i want using nfq_set_verdict. In fact every thing is going as i am expecting, that is the three protocol types icmp , tcp and udp packets are modified and reinjected In the queue then exits eth0 to the internet taking eth0 ip address as source address( effect of using MASQUERADE NAT rule). That is true for all packets EXCEPT: icmp ping reply or tcp ack packets. They exits to the internet taking the private ip of the lan device - 192.168.x.x and reaches the other side with this private source ip address. Any ideas. Thx.

  • Could you provide your iptables rules? Your question is unclear. – Willian Paixao Oct 27 '16 at 12:36

Im using iptables rules over ubuntu lab with 2 NICs eth0 to the internet and eth1 to the LAN I have used the well known iptables rules for NATing with masquerading on eth0 Sudo iptables --table nat --append POSTROUTING -o eth0 -j MASQUERADE sudo iptables -append FORWARD -i eth1 -j ACCEPT. sudo iptables -t mangle -A PREROUTING -j NFQUEUE --queue-num 0 Sudo iptables -t mangle -A OUTPUT -j NFQUEUE. these 4 rules are used to help me capture packets inside my program and modify packets or drop what i want using nfq_set_verdict. In fact every thing is going as i am expecting, that is the three protocol types icmp , tcp and udp packets are modified and reinjected In the queue then exits eth0 to the internet taking eth0 ip address as source address( effect of using MASQUERADE NAT rule). That is true for all packets EXCEPT: icmp ping reply or tcp ack packets. They exits to the internet taking the private ip of the lan device - 192.168.x.x and reaches the other side with this private source ip address. Any ideas. Thx.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.