Hi, I have a bit complex iptables+nat+mangle+vlan's setup within my box working perfectly with 2.6.30 and previous kernel versions. However, If I boot 2.6.31 then one of the capabilities stops working.
Replay packet's are silently ignored "only" at the interface doing SNAT+vlan. Rest of actions: iptables, nat, mangle's, policy based routing and NAT (no vlan) are working perfectly. To simplify the problem, here is the relevant setup and config:
Code:
["uid 1500" wget from 99.0.0.9]
|
LOCALHOST(10.0.0.1)vlan400 ==== (10.0.0.2)ROUTER ==== "MyPrivate" host(99.0.0.9)
Code:
# echo "100 MyPrivate" >> /etc/iproute2/rt_tables
# ip route add 10.0.0.1/24 dev vlan400 table MyPrivate
# ip route add 99.0.0.0/8 via 10.0.0.2 table MyPrivate
# iptables -A OUTPUT -t mangle -m owner --uid-owner 1500 -j MARK --set-mark 1500
# ip rule add fwmark 1500 table MyPrivate
# iptables -t nat -A POSTROUTING -o vlan400 -j SNAT --to-source 10.0.0.1
# echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
With this setup, all network traffic originated by user id 1500 should check first the "MyPrivate" table and if destination is 99.0.0.9 then send it out through vlan400 interface and perform source NAT.
Starts ok, traffic goes out on "vlan400" and remote host reply is correct, but then it stops. My localhost is not sending the last ACK, looks like it never sees the reply (SYN, ACK)
Code:
$ (running uid 1500)
$ wget from 99.0.0.9
:
10.0.0.1 SYN -->
<-- SYN, ACK 99.0.0.9
Just booting back with 2.6.30 starts working perfect again.
I've made lots of tests, googled, etc. but couldn't find anything, only some references to some issues corrected on 2.6.31 regarding NAT and connection tracking, but none similar to mine. Iptables version is not the problem, used 1.4.2, 1.4.3, 1.4.5 and allways works with kernel < 2.6.31.
Anybody knows if something important has been changed with 2.6.31? any idea?
Thanks in advance,
Luis
Linux Security Discussion about keeping your machines secure, and the crackers out.
Submit Your Article
Latest Articles
Editor's Choice
Article Categories
Join Linux Forums Today
Win Great Prizes
Linear Mode
