Re: IPTables vs. DNS (or : iptables doesn't change sourceport when MASQ'ing)

Article View: comp.os.linux.networking

Article #396

Back to comp.os.linux.networking Previous Next

#396

From: John Armstrong
Date: Mon, 06 Jan 2003 12:37

25 lines
2191 bytes

On Mon, 06 Jan 2003 12:02:56 GMT, nospam.koen.vdvelde@advalvas.be
(Koen Van de Velde) wrote:

>
>Hi John,
>I changed my masq-lines to  :
>  /sbin/iptables -t nat -A POSTROUTING -s 192.168.102.13 -p udp \
>    --sport 53 -o $EXTDEV -j MASQUERADE --to-port 61000:65095

You might want to add a line
  /sbin/iptables -t nat -A POSTROUTING -s 192.168.102.13 -p tcp \
    --sport 53 -o $EXTDEV -j MASQUERADE --to-port 61000:65095

As I understand it, if the dns reply is over a certain size, it goes
by tcp rather than udp, so while everything will work most of the time
without this, it will sometimes fail.

>  /sbin/iptables -A POSTROUTING -t nat -o $EXTDEV -j MASQUERADE    
>and this works fine now !
>
>thanks for your assistance,
>Koen.

-- 
John

Technical Details

Message-ID: <6vti1vgjpri5va2mp0c0rs4oonrvhg5d30@4ax.com>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!cyclone.bc.net!newspump.monmouth.com!newspeer.monmouth.com!newsfeed.icl.net!newsfeed.fjserv.net!diablo.theplanet.net!zen.net.uk!lovejoy.zen.co.uk.POSTED!not-for-mail

References:

<3e15b63e.2079245577@News.CIS.DFN.DE> <kceb1vkrt1c2c1hl5gmnadtsjtlq1mlmqu@4ax.com> <3e15c063.2081842881@News.CIS.DFN.DE> <mgli1vspehv391afnbeb08gdlenta1ucq9@4ax.com> <3e196fa3.14080897@News.CIS.DFN.DE>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 100a19,1167933813471c51
X-Google-Attributes: gid100a19,public
X-Google-Thread: 10669a,1167933813471c51
X-Google-Attributes: gid10669a,public
X-Google-Thread: 102510,1167933813471c51
X-Google-Attributes: gid102510,public
X-Google-ArrivalTime: 2003-01-06 04:37:38 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!cyclone.bc.net!newspump.monmouth.com!newspeer.monmouth.com!newsfeed.icl.net!newsfeed.fjserv.net!diablo.theplanet.net!zen.net.uk!lovejoy.zen.co.uk.POSTED!not-for-mail
From: John Armstrong <ja@ggrove.swinternet.co.uk>
Newsgroups: comp.os.linux.networking,nl.comp.os.linux.netwerken,be.comp.os.linux
Subject: Re: IPTables vs. DNS (or : iptables doesn't change sourceport when MASQ'ing)
Date: Mon, 06 Jan 2003 12:37:26 +0000
Message-ID: <6vti1vgjpri5va2mp0c0rs4oonrvhg5d30@4ax.com>
References: <3e15b63e.2079245577@News.CIS.DFN.DE> <kceb1vkrt1c2c1hl5gmnadtsjtlq1mlmqu@4ax.com> <3e15c063.2081842881@News.CIS.DFN.DE> <mgli1vspehv391afnbeb08gdlenta1ucq9@4ax.com> <3e196fa3.14080897@News.CIS.DFN.DE>
X-Newsreader: Forte Agent 1.93/32.576 English (American)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 25
Organization: Zen Internet
NNTP-Posting-Host: 212.23.14.155
X-Trace: 1041856646 lovejoy.zen.co.uk 29924 212.23.14.155
X-Complaints-To: abuse@zen.co.uk

Reply to Parent Message