linux-kernel - iptables 2.6.38, can kernel erroneously bypass PREROUTING ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4E7616F5.7080009@cdi.cz>
Date:	Sun, 18 Sep 2011 18:06:13 +0200
From:	Martin Devera <martin.devera@....cz>
To:	linux-kernel@...r.kernel.org
Subject: iptables 2.6.38, can kernel erroneously bypass PREROUTING ?

Hello,

we have problem with high-bw router (1gbit, conntrack, nat, htb qos) 
where after some time (weeks) DNAT stops working.
I tried to include "-t raw -A PREROUTING -i eth0" an it got ZERO hits
while -i eth1 has many.
Thus DNAT (in -t nat) doesn't work but interestingly conntrack (and thus
SNAT records) is ok - packets from eth0 sems to be routed.
Only they "somehow" skip all PREROUTING chains.. But from sources
I can find no way how only eth0 pkts could skip PREROUTING but still
be routed and contracked ... Anyone has a clue ?

A didn't more investigation as I had to reboot it - it always helps.

thanks, Martin
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/