>В Птн, 26/01/2007 в 12:24 +0100, Jan Engelhardt пишет:
>> >http://www.meteor.dp.ua/casper/firewill.pdf
>> >
>> >how would I make a "feature request" to ask for, say, "mangle2" table
>> >that is just after "nat" in POSTROUTING? The only reason for this move
>> >is the need for ability to catch un-DNAT'ed packets with -j ULOG or
>> >(better) to -j QUEUE.
>>
>> And -t nat -A POSTROUTING -m conntrack ! --ctstate DNAT
>> as a last rule won't do?
>
>This will (probably) catch packets that hasn't been DNAT'ed.
>BUT, the thing I need it to catch replay packets that has already passed
>"un-DNAT" procedure.
Ah, now I get what you mean with un-DNAT. (Unwrapping I'd say ;-)
Too bad, I don't see a way. But as an intermediate workaround, you could
copy ULOG/QUEUE to a new module, say, MYULOG/MYQUEUE and modify it so as to
display the original address pair (which should easily be possible with kernel
code).
-`J'
--
|