В Вто, 30/01/2007 в 19:02 +0100, Jan Engelhardt пишет:
> On Jan 30 2007 11:46, Jan Engelhardt wrote:
> >>Excuse me for double asking, but is this the place for such a feature
> >>request?
> >
> >At least it's not the wrong place.
>
> For the mailinglist record, the solutions is:
>
> -t nat -A POSTROUTING -m conntrack --ctstate DNAT --ctorigdst x.x.x.x
Just to make sure. This rule will match the packets with canntrack state
"DNAT" and whose original (before DNAT) destination address was x.x.x.x,
right?
If I add -j ULOG to this rule what would be logged packet source address
for replay packet (Server->Client)? Original, that client was initially
connected to, or real, that was set during DNAT?
By the way does -m conntrack --ctstate DNAT --ctorigdst x.x.x.x match
request or replay packets or packets belonging to connection which was
originally made to x.x.x.x?
--
Покотиленко Костик <casper@meteor.dp.ua>
|