Re: snat in PREROUTING chain?

Op vr, 27-04-2007 te 23:32 -0400, schreef Stephen M. Rumble:
> Hi all,
> 
> I went ahead and enabled snat rules in PREROUTING and dnat rules in  
> POSTROUTING by simply including the NF_BR_PRE_ROUTING and  
> NF_BR_POST_ROUTING bits in the userland (extensions/ebt_nat.c lines  
> 151 and 168) and kernel check routines  
> (net/bridge/netfilter/ebt_dnat.c:46 and ebt_snat.c:66). This appears  
> to work fine for my purposes. Kudos on the flexible design!

Nice you could solve your problem :)

> I'd still be interested to know why they're not permitted by default.  
> I suppose in most instances such functionality wouldn't be  
> necessary/useful, but Xen's virtual interfaces make for sort of an  
> inversion of the expected behaviour.

That's iptables' design mirrored. The iptables idea is that all
filtering happens in the FORWARD chain (for routed traffic). Since the
FORWARD chain is traversed after the PREROUTING chain, altering the
source address in PREROUTING would mean the FORWARD chain wouldn't know
who the original sender was. With ebtables you can basically do
filtering anywhere, but I decided it would be best and the least
confusing to mirror iptables' design here. Usually, design decisions
backfire sooner or later, though ;)

cheers,
Bart



-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/