Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I'm still reading the iptables manual page and other documents and digging around questions and their answers.
This is the problem which arises. When we setup the NAT we use a POSTROUTING rule such as this:
iptables -A POSTROUTING -t nat -j MASQUERADE -o eth0
It seems when a packet hits this chain then an internal host needs to initialize some connection with the internet right? Incoming traffic will route through the same path without hitting the chain? Am I right on this?
The POSTROUTING chain is checked for all packets which leave the system, even the locally generated ones (they leave out PREROUTING and use OUTPUT instead).
The rule is limited to traffic which is outgoing via eth0. "Incoming" is every traffic being routed (if you related this to POSTROUTING). You probably mean traffic from the Internet (eth0). Usually traffic which comes in on eth0 will not leave the system via eth0.
POSTROUTING affects outgoing traffic only (and only the first packet of a connection). If replies arrive on eth0 then they are recognized as part of the SNAT connection and their destination address (and port) are automatically translated to their original values (those overwritten by the MASQUERADE target).
In iptables only the first packet of a connection hits the chains in the nat table (this is different from chains in other tables). Packets related to an existing connection are translated automatically based on the mappings that were established when the first packet was processed.
If an incoming packet arrives that does not match an existing connection and doesn't match a rule in the NAT table then it will be processed without NAT (which may involve forwarding it, passing it up the protocol stack locally or dropping it depending on the destination IP and iptables rules in other tables).
