How can private IPV4 addresses get past iptables NAT (tcp RST,FIN)

Posted by gscott on Server Fault See other posts from Server Fault or by gscott
Published on 2012-10-14T21:19:47Z Indexed on 2012/10/14 21:39 UTC
Read the original article Hit count: 365

Filed under:

iptables

|

router

|

nat

|

tcp

I've got a router performing simple NAT translation using iptables iptables -t nat -o -j MASQUERADE

This works fine almost all of the time except for one particular case where some TCP RST and FIN packets are leaving the router un-NAT'd.

In this scenario I setup 1 or 2 client computers streaming Flash video (eg www.nasa.gov/ntv) At the router I then tear down and re-establish the public interface (which is a modem) As expected the Flash streams stall out. After the connection is re-established and I try to refresh the Flash pages, I see some TCP RST and [FIN,ACK] packets leaving the public interface (I assume as Flash attempts to recover its stream).

I don't know how these packets can leave the router non-NAT'd

© Server Fault or respective owner

Related posts about iptables

Sometimes this script fails to update the iptables

as seen on Server Fault - Search for 'Server Fault'
It does not happen often, but sometimes after running the below script, checking the iptables with service iptables status shows that they weren't updated and the script doesn't output any error. The iptables is structured as look-up tree (long repeated sections snipped): #!/bin/sh iptables -t… >>> More
My current iptable configuration doesn't work [on hold]

as seen on Server Fault - Search for 'Server Fault'
sudo chkconfig iptables off /etc/init.d/iptables on ### Clear/flush iptables sudo iptables -F sudo iptables -P INPUT ACCEPT sudo iptables -P OUTPUT ACCEPT sudo iptables -P FORWARD ACCEPT ### Allow SSH iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT iptables… >>> More
L2TP iptables port forward

as seen on Server Fault - Search for 'Server Fault'
Hi all, I'm setting up port forwarding for an L2TP VPN connection to the local Windows 2003 VPN server. The router is a simpel Debian machine with iptables. The VPN server works perfect. But I cannot log in from the WAN. I'm missing something. The VPN server is using a pre-shared key (L2TP) and… >>> More
iptables -P FORWARD DROP makes port forwarding slow

as seen on Server Fault - Search for 'Server Fault'
I have three computers, linked like this: box1 (ubuntu) box2 router & gateway (debian) box3 (opensuse) [10.0.1.1] ---- [10.0.1.18,10.0.2.18,10.0.3.18] ---- [10.0.3.15] | box4, www [10.0.2.1] Among other… >>> More
IPtables AWS EC2 NAT/Reverse NAT - For Reverse Proxy style setup but with IPtables

as seen on Server Fault - Search for 'Server Fault'
I was thinking initially needing to do a reverse proxy or something so I could get some SSL/TLS traffic look like it is being terminated at a server and IP address in the AWS cloud, and then that traffic is forwarded onto our actual web servers that aren't in the cloud... I've not done much iptables… >>> More

Related posts about router

cisco 2911 router vs 2811 router

as seen on Server Fault - Search for 'Server Fault'
Just wondering if anyone has experience with the cisco 2911 or 2900 series routers. I understand it is newer and similar to the 2811 but more robust. The price difference is not that much more. I am trying to determine if I should go with the 29xx or 28xx series for a small-medium sized company… >>> More
Ubuntu 10.10 Ad-Hoc Setup (from Wireless Router, to Ubuntu Server/Desktop to Wireless Router)

as seen on Super User - Search for 'Super User'
Okay, so I know there are different approaches for this, but I will explain my story briefly before getting to the technical stuff. My fiancée and I are going through some financial issues (as I assume a lot of us are). We ended up having to move from our house and stay with some friends/family for… >>> More
linksys wrt54g router to a Cisco router?

as seen on Super User - Search for 'Super User'
This may be a strange question but I have no clue. I currently have a basic linksys wrt54g router fo9r my home network. I am considering getting a rack/cabinet and running a home server or 2 and hooking up my home network to it. If I were to do0 this I could pick up a cisco rack mounted router… >>> More
Prolink 5200 modem/router connected to Linksys WRT54GS wireless router

as seen on Super User - Search for 'Super User'
Hello does any one knows how to conect prolink 5200 single port modem/router with Linksys wireless router ......i dont know how to configerat these to togather >>> More
How to Reuse Your Old Wi-Fi Router as a Network Switch

as seen on How to geek - Search for 'How to geek'
Just because your old Wi-Fi router has been replaced by a newer model doesn’t mean it needs to gather dust in the closet. Read on as we show you how to take an old and underpowered Wi-Fi router and turn it into a respectable network switch (saving your $20 in the process). Image by mmgallan… >>> More