Find the answer to your Linux question:
Results 1 to 3 of 3
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1

    2.6.31 iptables ignores reply pkt at interface SNAT+VLAN

    Hi, I have a bit complex iptables+nat+mangle+vlan's setup within my box working perfectly with 2.6.30 and previous kernel versions. However, If I boot 2.6.31 then one of the capabilities stops working.

    Replay packet's are silently ignored "only" at the interface doing SNAT+vlan. Rest of actions: iptables, nat, mangle's, policy based routing and NAT (no vlan) are working perfectly. To simplify the problem, here is the relevant setup and config:

    ["uid 1500" wget from]
    LOCALHOST(  ==== ( ==== "MyPrivate" host(
    # echo "100 MyPrivate" >> /etc/iproute2/rt_tables
    # ip route add dev vlan400 table MyPrivate
    # ip route add via table MyPrivate
    # iptables -A OUTPUT -t mangle -m owner --uid-owner 1500 -j MARK --set-mark 1500
    # ip rule add fwmark 1500 table MyPrivate
    # iptables -t nat -A POSTROUTING -o vlan400 -j SNAT --to-source
    # echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
    With this setup, all network traffic originated by user id 1500 should check first the "MyPrivate" table and if destination is then send it out through vlan400 interface and perform source NAT.

    Starts ok, traffic goes out on "vlan400" and remote host reply is correct, but then it stops. My localhost is not sending the last ACK, looks like it never sees the reply (SYN, ACK)

    $ (running uid 1500)
    $ wget from
    : SYN -->
                       <-- SYN, ACK
    Just booting back with 2.6.30 starts working perfect again.

    I've made lots of tests, googled, etc. but couldn't find anything, only some references to some issues corrected on 2.6.31 regarding NAT and connection tracking, but none similar to mine. Iptables version is not the problem, used 1.4.2, 1.4.3, 1.4.5 and allways works with kernel < 2.6.31.

    Anybody knows if something important has been changed with 2.6.31? any idea?

    Thanks in advance,

  2. #2
    I am seeing the same issue with kernel 2.6.31 on openSuse 11.2. Has anyone else seen (and hopefully resolved!) this? Thanks in advance for any help.

  3. #3


    The issue is the /proc/sys/net/ipv4/conf/X/rp_filter file where X is "all", "default", or an interface name. Echoing 0 into this file made everything work fine under Kernel 2.6.31, echoing 1 (which is what was in rp_filter for X=default) produces the problem. Apparently the use of this file changed with kernel 2.6.31 that caused my problem.

  4. $spacer_open

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts