Altering outgoing IP Address without Connection Tracking
I'd like to alter the outgoing IP address (from internal to external LB) on all packets sent on a specific port, without incurring the overhead of running conntrack. DNAT of course requires conntrack. But I can't think of a reason why this simple substitution would require stateful representation of packet flows. I was able to find one reference to someone trying to mange the RAW packets [1] in 2008, but apparently without success.
Is it currently possible to alter outgoing IP addresses without connection tracking?
[1]
http://www.linuxquestions.org/questions/linux-networking-3/iptables-notrack-670012/
(Sorry for top posting; Gmail java mobile client sucks)
IIRC, You can do stateless NAT using iproute2.
Rgds,
Quoted 18 lines · Chris Burroughs
I'd like to alter the outgoing IP address (from internal to external LB) on all packets sent on a specific port, without incurring the overhead of running conntrack. DNAT of course requires conntrack. But I can't think of a reason why this simple substitution would require stateful representation of packet flows. I was able to find one reference to someone trying to mange the RAW packets [1] in 2008, but apparently without success.
Is it currently possible to alter outgoing IP addresses without connection tracking?
[1]
http://www.linuxquestions.org/questions/linux-networking-3/iptables-notrack-670012/
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Signature · 3 lines
-- Pandu E Poluan - IT Optimizer My website: http://pandu.poluan.info/
Quoted 6 lines · Pandu Poluan
Quoted 2 lines · Chris Burroughs
I'd like to alter the outgoing IP address [...] without incurring the overhead of running conntrack.
(Sorry for top posting; Gmail java mobile client sucks)
Take another client, then?
Quoted 1 line
IIRC, You can do stateless NAT using iproute2.
That sounds so terribly obscure that it might as well not be implemented in the first place.
Yes, the manpage is clear on that, once read:
|./man/man8/ip.8:Route NAT is no longer supported in Linux 2.6.
More likely successful is xt_RAWDNAT / xt_RAWSNAT instead (including the pains coming from stateless NAT).