I am using iptables in conjunction with net-filter queue in order to alter packets programmatically.

Im using iptables rules over ubuntu lab with 2 NICs eth0 to the internet and eth1 to the LAN I have used the well known iptables rules for NATing with masquerading on eth0.

sudo iptables --table nat --append POSTROUTING -o eth0 -j MASQUERADE 
sudo iptables -append FORWARD -i eth1 -j ACCEPT. 
sudo iptables -t mangle -A PREROUTING -j NFQUEUE --queue-num 0 
sudo iptables -t mangle -A OUTPUT -j NFQUEUE

These 4 rules are used to help me capture packets inside my program and modify packets or drop what I want using nfq_set_verdict.

In fact everything is going as I am expecting, that is the three protocol types icmp, tcp and udp packets are modified and reinjected. In the queue then exits eth0 to the internet taking eth0 ip address as source address (effect of using MASQUERADE NAT rule).
That is true for all packets EXCEPT: ICMP ping reply or TCP ACK packets.
They exit to the internet taking the private ip of the lan device - 192.168.x.x at eth1 and reaches the other side with this private source ip address.

Any ideas. Thx.

  • I don't understand how an ICMP ping reply would be generated by an IP behind the masquerade. How can the internet ping a specific host behind the masquerade; the masquerade is a single IP address, and attempts to ping it should be handled by that IP without any masquerading happening. – sourcejedi Oct 29 '16 at 14:41
  • @sourcejedi my friend i am building a tunneling vpn – user191523 Oct 29 '16 at 14:43
  • @sourcejedi i think that the ubuntu kernel handles the icmp reply and tcp ack packets differently so u can not alter source ip of these packets with the eth0 public ip. – user191523 Oct 29 '16 at 14:46
  • that's quite an ommission!! So these packets aren't icmp replies or tcp acks once you've re-injected them; they're encapsulated in some other protocol – sourcejedi Oct 29 '16 at 14:50
  • Not other protocol i do not use ESP. I USE the same proto without change just encapsulation. – user191523 Oct 29 '16 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.