Iptables + traceroute + NAT = invalid packet? :-(

Hello!

I have a problem with the connection tracking state extension.
I want to allow traceroute from my local network, so I configured my firewall to accept outgoing packets from my network. I also accept established, related pachets and log&drop invalid packets:

iptables -A INPUT -m state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m state INVALID -j LOG iptables -A INPUT -m state INVALID -j DROP iptables -A INPUT -i <LAN_IFACE> -j ACCEPT

iptables -A OUTPUT -m state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state INVALID -j LOG iptables -A OUTPUT -m state INVALID -j DROP

iptables -A FORWARD -m state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m state INVALID -j LOG iptables -A FORWARD -m state INVALID -j DROP iptables -A RORWARD -i <LAN_IFACE> -j ACCEPT

iptables -A POSTROUTING -o <INET_IFACE> -j SNAT --to-source <INET_IP>

However, at this time a traceroute from my local network to an external host looks like that:

---
Tracing route to ya.ru [213.180.193.123]
over a maximum of 30 hops:

 1     *        *        *     Request timed out.
 2    22 ms    23 ms    31 ms  213.156.200.xxx
 3    31 ms    21 ms    23 ms  213.156.195.xxx
 4    25 ms    50 ms    25 ms  e12.bcn1.xxx.xxx [213.156.192.xxx]

etc.
---

cat /var/log/messages
-------------

Jan 12 14:30:02 serv kernel: INVALID output: IN= OUT=eth0 SRC=192.168.2.1 DST=192.168.2.10 LEN=120 TOS=0x00 PREC=0xC0 TTL=64 ID=54714 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.2.10 DST=213.180.193.123 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=26615 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=32768 ]

-------------

So why does the time-exceeded answer have the state INVALID, though it should be RELATED as far as i can see it? Am I doing something wrong or is it even an iptables bug?

Thank you!
WBR, Dmitry Ananjev
[email protected]