netdev - Re: Why can't we SNAT (or inverse DNAT) in PREROUTING?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrUR9VKJ0jJwqF79Jm6Y954yhMrA=ifzRWCvvgHzOpgzag@mail.gmail.com>
Date:	Fri, 26 Jun 2015 14:18:36 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Francois Romieu <romieu@...zoreil.com>
Cc:	Network Development <netdev@...r.kernel.org>
Subject: Re: Why can't we SNAT (or inverse DNAT) in PREROUTING?

[re-add netdev -- I assume you meant to reply all]

On Fri, Jun 26, 2015 at 1:32 PM, Francois Romieu <romieu@...zoreil.com> wrote:
> Andy Lutomirski <luto@...capital.net> :
> [...]
>> Could we add some option to do SNAT and inverse DNAT before routing?
>
> I haven't used it for ages but what's wrong with iptables + fwmark ?
>
> It takes place in PREROUTING.

This works, but it seems unnecessarily painful.  It means that all of
my policy rules have to be duplicated with fwmark rules based on '-m
conntrack' or similar.

Shouldn't the order of operations be:

1. Check rp_filter.

2. Handle NAT.

3. Routing decision.

?

--Andy

>
> --
> Ueimor

-- 
Andy Lutomirski
AMA Capital Management, LLC
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html