SNAT in OUTPUT chain of the nat table question?

Is there a good reason that I am unable to conceive of at the moment why SNAT is not a valid target in the OUTPUT chain of the nat table?

Thanks,
Steve

The OUTPUT chain is only for outgoing packets from the linux box itself.

The POSTROUTING chain is the one that contains all packets being routed/forwarded.

Ranjeet Shetye
Senior Software Engineer
Zultys Technologies
Ranjeet dot Shetye2 at Zultys dot com
http://www.zultys.com/

From 'man iptables':

SNAT
This target is only valid in the nat table, in the POSTROUTING chain. It specifies that the source address

SNAT gets done just as packets go out, hence only in the POSTROUTING chain as you only know where they're going by then.

-Ath

- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME

Turn this around somewhat. Can you present a case where SNAT would need to be done in the nat OUTPUT chain, that could not also be performed in the nat POSTROUTING chain achieving the same effect? Even if you're going to localhost, packets don't go from OUTPUT straight to INPUT.

That said, connections originating on the local box addressed to any IP of the box itself do NOT appear in the nat-PREROUTING chain. (If you try to DNAT in PREROUTING it still comes back in INPUT instead of forwarding) Obviously this is a case where DNAT would be required in nat OUTPUT, where it is in fact a valid target. This is the only way to DNAT a connection from the box to itself and send it elsewhere.

j

(stealing someone else's apropos sig, I believe Antony Stone's :^) --
Perfection in design is achieved not when there is nothing left to add, but rather when there is nothing left to take away.

- Antoine de Saint-Exupery