Patrick McHardy
c68cd6cc21
netfilter: nf_nat: support user-specified SNAT rules in LOCAL_IN ...
2.6.34 introduced 'conntrack zones' to deal with cases where packets
from multiple identical networks are handled by conntrack/NAT. Packets
are looped through veth devices, during which they are NATed to private
addresses, after which they can continue normally through the stack
and possibly have NAT rules applied a second time.
This works well, but is needlessly complicated for cases where only
a single SNAT/DNAT mapping needs to be applied to these packets. In that
case, all that needs to be done is to assign each network to a seperate
zone and perform NAT as usual. However this doesn't work for packets
destined for the machine performing NAT itself since its corrently not
possible to configure SNAT mappings for the LOCAL_IN chain.
This patch adds a new INPUT chain to the NAT table and changes the
targets performing SNAT to be usable in that chain.
Example usage with two identical networks (192.168.0.0/24) on eth0/eth1:
iptables -t raw -A PREROUTING -i eth0 -j CT --zone 1
iptables -t raw -A PREROUTING -i eth0 -j MARK --set-mark 1
iptables -t raw -A PREROUTING -i eth1 -j CT --zone 2
iptabels -t raw -A PREROUTING -i eth1 -j MARK --set-mark 2
iptables -t nat -A INPUT -m mark --mark 1 -j NETMAP --to 10.0.0.0/24
iptables -t nat -A POSTROUTING -m mark --mark 1 -j NETMAP --to 10.0.0.0/24
iptables -t nat -A INPUT -m mark --mark 2 -j NETMAP --to 10.0.1.0/24
iptables -t nat -A POSTROUTING -m mark --mark 2 -j NETMAP --to 10.0.1.0/24
iptables -t raw -A PREROUTING -d 10.0.0.0/24 -j CT --zone 1
iptables -t raw -A OUTPUT -d 10.0.0.0/24 -j CT --zone 1
iptables -t raw -A PREROUTING -d 10.0.1.0/24 -j CT --zone 2
iptables -t raw -A OUTPUT -d 10.0.1.0/24 -j CT --zone 2
iptables -t nat -A PREROUTING -d 10.0.0.0/24 -j NETMAP --to 192.168.0.0/24
iptables -t nat -A OUTPUT -d 10.0.0.0/24 -j NETMAP --to 192.168.0.0/24
iptables -t nat -A PREROUTING -d 10.0.1.0/24 -j NETMAP --to 192.168.0.0/24
iptables -t nat -A OUTPUT -d 10.0.1.0/24 -j NETMAP --to 192.168.0.0/24
Signed-off-by: Patrick McHardy <kaber@trash.net>
2010-06-17 06:12:26 +02:00
9p: add 9P2000.L rename operation
2010-05-21 16:44:34 -05:00
Bluetooth: Create per controller workqueue
2010-05-10 09:34:03 +02:00
caif: Bugfix - use standard Linux lists
2010-05-23 23:57:41 -07:00
tree-wide: fix typos "ass?o[sc]iac?te" -> "associate" in comments
2010-02-15 15:38:10 +01:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
netfilter: nf_nat: support user-specified SNAT rules in LOCAL_IN
2010-06-17 06:12:26 +02:00
ipv6: ip6mr: support multiple tables
2010-05-11 14:40:55 +02:00
phonet: use call_rcu for phonet device free
2010-06-09 16:14:25 -07:00
net: use __packed annotation
2010-06-03 03:21:52 -07:00
pkt_sched: skbedit add support for setting mark
2009-10-22 21:56:42 -07:00
tipc: Update commenting in TIPC API
2010-05-12 23:02:23 -07:00
pkt_sched: gen_kill_estimator() rcu fixes
2010-06-11 18:37:08 -07:00
net: Add checking to rcu_dereference() primitives
2010-02-25 09:41:03 +01:00
net: sock_def_readable() and friends RCU conversion
2010-05-01 15:00:15 -07:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6
2010-06-11 11:34:06 -07:00
cls_cgroup: Initialise classid when module is absent
2010-05-25 18:53:57 -07:00
net: fix compat_sys_recvmmsg parameter type
2009-12-11 15:07:56 -08:00
net: use __packed annotation
2010-06-03 03:21:52 -07:00
decnet: Remove unused FIB metric macros.
2010-03-27 19:23:46 -07:00
net: use __packed annotation
2010-06-03 03:21:52 -07:00
net-next: remove useless union keyword
2010-06-10 23:31:35 -07:00
net: check for refcount if pop a stacked dst_entry
2010-06-04 15:56:00 -07:00
net: fib_rules: mark arguments to fib_rules_register const and __net_initdata
2010-04-26 16:02:04 +02:00
flow: virtualize flow cache entry methods
2010-04-07 03:43:18 -07:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
net: CONFIG_NET_NS reduction
2010-06-02 05:16:23 -07:00
ipv4: raw: move struct raw_sock and raw_sk() to include/net/raw.h
2010-04-13 14:49:31 -07:00
wireless: update radiotap parser
2010-02-08 16:50:53 -05:00
ieee802154: add an mlme_ops call to retrieve PHY object
2009-11-06 14:32:18 +03:00
ipv6: Replace inet6_ifaddr->dead with state
2010-05-18 15:36:06 -07:00
net: replace ipfragok with skb->local_df
2010-04-15 23:36:37 -07:00
tcp: Fix a connect() race with timewait sockets
2009-12-08 20:17:51 -08:00
net: replace ipfragok with skb->local_df
2010-04-15 23:36:37 -07:00
tcp: Fix a connect() race with timewait sockets
2009-12-08 20:17:51 -08:00
net: Make RFS socket operations not be inet specific.
2010-04-27 15:11:48 -07:00
net: suppress RCU lockdep false positive in twsk_net()
2010-04-27 12:39:01 -07:00
inetpeer: Optimize inet_getid()
2009-11-13 20:46:58 -08:00
ip: ip_ra_control() rcu fix
2010-06-10 22:47:08 -07:00
net-next: remove useless union keyword
2010-06-10 23:31:35 -07:00
net: sk_dst_cache RCUification
2010-04-13 01:41:33 -07:00
net: use __packed annotation
2010-06-03 03:21:52 -07:00
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
2009-11-06 00:55:55 -08:00
ipvs: SCTP Trasport Loadbalancing Support
2010-02-18 12:31:05 +01:00
percpu: add __percpu sparse annotations to net
2010-02-16 23:05:38 -08:00
net-next: remove useless union keyword
2010-06-10 23:31:35 -07:00
ipv6: Refactor update of IPv6 flowi destination address for srcrt (RH) option
2010-06-02 07:08:31 -07:00
net: use __packed annotation
2010-06-03 03:21:52 -07:00
include/net/iw_handler.h: Use SIOCIWFIRST not SIOCSIWCOMMIT in comment
2010-03-31 14:49:12 -04:00
llc: convert llc_sap_list to RCU
2009-12-26 20:46:28 -08:00
llc: use a device based hash table to speed up multicast delivery
2009-12-26 20:43:57 -08:00
wireless: fix kernel-doc
2010-06-08 09:31:21 -04:00
net: use __packed annotation
2010-06-03 03:21:52 -07:00
ipv6 mcast: Introduce include/net/mld.h for MLD definitions.
2010-04-23 13:35:55 +09:00
net: use __packed annotation
2010-06-03 03:21:52 -07:00
netfilter: bridge-netfilter: Fix MAC header handling with IP DNAT
2010-04-15 12:26:39 +02:00
nsproxy: remove INIT_NSPROXY()
2010-03-12 15:52:40 -08:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
netlink: fix unaligned access in nla_get_be64()
2010-03-19 22:47:23 -07:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
net: rename skb->iif to skb->skb_iif
2009-11-20 15:35:04 -08:00
net: Define accessors to manipulate QDISC_STATE_RUNNING
2010-06-02 03:23:51 -07:00
net: drop capability from protocol definitions
2009-11-05 21:40:17 -08:00
ipv4: ipmr: support multiple tables
2010-04-13 14:49:34 -07:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
cfg80211: add regulatory hint disconnect support
2010-02-01 15:40:06 -05:00
tcp: account SYN-ACK timeouts & retransmissions
2010-01-17 19:09:39 -08:00
net-next: remove useless union keyword
2010-06-10 23:31:35 -07:00
rtnetlink: support specifying device flags on device creation
2010-02-27 02:43:40 -08:00
net: add additional lock to qdisc to increase throughput
2010-06-02 05:09:29 -07:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
tcp: fix outsegs stat for TSO segments
2010-04-22 16:00:00 -07:00
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
2010-06-06 17:42:02 -07:00
tcp: Fix slowness in read /proc/net/tcp
2010-06-07 00:43:42 -07:00
IPv6: Add dontfrag argument to relevant functions
2010-04-23 23:35:28 -07:00
udp: bind() optimisation
2009-11-10 20:54:38 -08:00
wext: refactor
2009-10-07 16:39:43 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2009-12-09 19:43:33 -08:00
ieee802154: add support for creation/removal of logic interfaces
2009-11-06 14:32:24 +03:00
X25: Move accept approve flag to bitfield
2010-05-17 17:39:27 -07:00
X25: Add if_x25.h and x25 to device identifiers
2010-04-22 16:12:36 -07:00
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
2010-04-11 14:53:53 -07:00
c68cd6cc21