4

I'm still reading the iptables manual page and other documents and digging around questions and their answers.

This is the problem which arises. When we setup the NAT we use a POSTROUTING rule such as this:

iptables -A POSTROUTING -t nat -j MASQUERADE -o eth0

It seems when a packet hits this chain then an internal host needs to initialize some connection with the internet right? Incoming traffic will route through the same path without hitting the chain? Am I right on this?

|improve this question

migrated from serverfault.com Jun 5 '13 at 13:18

This question came from our site for system and network administrators.

5

The POSTROUTING chain is checked for all packets which leave the system, even the locally generated ones (they leave out PREROUTING and use OUTPUT instead).

The rule is limited to traffic which is outgoing via eth0. "Incoming" is every traffic being routed (if you related this to POSTROUTING). You probably mean traffic from the Internet (eth0). Usually traffic which comes in on eth0 will not leave the system via eth0.

POSTROUTING affects outgoing traffic only (and only the first packet of a connection). If replies arrive on eth0 then they are recognized as part of the SNAT connection and their destination address (and port) are automatically translated to their original values (those overwritten by the MASQUERADE target).

|improve this answer
  • Yes eth0 is the internet connection. So incoming connections to the eth0 will not hit that POSTROUTING chain in NAT table but it will be considered as SNAT and will be translated to their original values? – sandun dhammika Jun 5 '13 at 14:53
  • I'm asking this question because, we didn't explicitly didn't mention such this. It's happening implicitly. Am I right on that. – sandun dhammika Jun 5 '13 at 14:54
  • @sandundhammika For each incoming packet the connection tracking checks whether it is part of a known connection. If it belongs to a known connection and the outgoing parts of this connection are masqueraded then the automatic translation takes place. This does not affect incoming packets which create a new connection. – Hauke Laging Jun 5 '13 at 14:57
0

In iptables only the first packet of a connection hits the chains in the nat table (this is different from chains in other tables). Packets related to an existing connection are translated automatically based on the mappings that were established when the first packet was processed.

If an incoming packet arrives that does not match an existing connection and doesn't match a rule in the NAT table then it will be processed without NAT (which may involve forwarding it, passing it up the protocol stack locally or dropping it depending on the destination IP and iptables rules in other tables).

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.