2

In order to debug a networking problem, I introduced logging with iptables:

for chain in INPUT FORWARD OUTPUT; do
    iptables -A $chain -j LOG --log-level info --log-prefix filter_$chain
done
for chain in PREROUTING INPUT OUTPUT POSTROUTING; do
    iptables -t nat -A $chain -j LOG --log-level info --log-prefix nat_$chain
done

Now for testing purposes, I created two network namespaces and two veth pairs, so that the network namespaces communicate via the default namespace:

namespace a               default namespace         namespace b
10.20.30.50 ---- 10.20.30.40  <------>  1.2.3.4 ---- 1.2.3.5
          veth pair          forwarding        veth pair

When I enter namespace a and ping the host 1.2.3.5 in namespace b, the echo request and reply get forwarded in the default namespace. In the system logs, I see the following:

nat_PREROUTING [...] SRC=10.200.30.50 DST=1.2.3.5 [...] TTL=64 ID=16847 DF PROTO=ICMP TYPE=8 CODE=0 ID=14460 SEQ=1
filter_FORWARD [...] SRC=10.200.30.50 DST=1.2.3.5 [...] TTL=63 ID=16847 DF PROTO=ICMP TYPE=8 CODE=0 ID=14460 SEQ=1
nat_POSTROUTING [...] SRC=10.200.30.50 DST=1.2.3.5 [...] TTL=63 ID=16847 DF PROTO=ICMP TYPE=8 CODE=0 ID=14460 SEQ=1

filter_FORWARD [...] SRC=1.2.3.5 DST=10.200.30.50 [...] TTL=63 ID=36035 PROTO=ICMP TYPE=0 CODE=0 ID=14460 SEQ=1

filter_FORWARD [...] SRC=10.200.30.50 DST=1.2.3.5 [...] TTL=63 ID=16866 DF PROTO=ICMP TYPE=8 CODE=0 ID=14460 SEQ=2
filter_FORWARD [...] SRC=1.2.3.5 DST=10.200.30.50 [...] TTL=63 ID=36274 PROTO=ICMP TYPE=0 CODE=0 ID=14460 SEQ=2

I wonder why only the first echo request hits the log target in the PREROUTING and in the POSTROUTING chain, while all subsequent packages merely hit the log target in the FORWARD chain.

1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 13 '17 at 3:15
2

This is a side effect of route cache and connection tracking. The packet of a new flow will go through the full stack, all subsequent packets match an existing flow (conntrack entry) and are immediately forwarded.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.