2

I use iptables snat on my gateway to change local source ip addresses to external. The trouble is that after I change the rules (or even if I flush iptables nat table) gateway keeps using the old rule till I reboot the gateway. I use Ubuntu 14.04 Server as a running operation system. So, for example after I enter

iptables -t nat -A POSTROUTING -s 10.0.0.129 -j SNAT --to-source 1.2.3.4

External address for 10.0.0.129 is 1.2.3.4 and on the external gateway interface I could see something like that

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:48:07.920936 IP 1.2.3.4 > 8.8.8.8: ICMP echo request, id 2425, seq 1, length 64
09:48:08.920066 IP 1.2.3.4 > 8.8.8.8: ICMP echo request, id 2425, seq 2, length 64
09:48:09.920422 IP 1.2.3.4 > 8.8.8.8: ICMP echo request, id 2425, seq 3, length 64

and even after

iptables -F 
iptables -t nat -F 
iptables -t nat -A POSTROUTING -s 10.0.0.129 -j SNAT --to-source 4.3.2.1

the result will be the same

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:54:20.674671 IP 1.2.3.4 > 8.8.8.8: ICMP echo request, id 2666, seq 1, length 64
09:54:21.674997 IP 1.2.3.4 > 8.8.8.8: ICMP echo request, id 2666, seq 2, length 64
09:54:22.676283 IP 1.2.3.4 > 8.8.8.8: ICMP echo request, id 2666, seq 3, length 64

the new rules take effect only after I reboot the system This used to happen occasionally, but recently it turned out that I am not able to change these rules without reboot.

koresh
  • 21
  • 1
  • This may be connection tracking caching this. – wurtel Mar 05 '15 at 12:41
  • I have exactly the same behaviour using DNAT. I drop a rule and redirection is still working. I have seen that the rule is still present in the conntrack table. – kranteg Mar 05 '15 at 13:29
  • 1
    Install `conntrack tools` and check run `conntrack -L`. You will find some entries related to your icmp. Conntrack entries (in brief) have a timeout of 180 sec so juste wait 180 sec before running your ping and it should work. Or just drop the related connection with `conntrack -D xxxxx`. – kranteg Mar 10 '15 at 14:09

0 Answers0