answer packages rejected between mangle/prerouting and nat/prerouting

Question

I am currently configuring a ubiquity edgerouter for our network. We have one uplink port (eth2) and two internal ports (eth0; with vlan 1) and eth3 (with vlans 2,3 and 4). uplink and vlan 1 have public IPs. vlans 2-4 use internal (192.168.0.0/16) IPs. All Traffic coming in from vlans 2-4 is NATed to a public IP. I have zone based firewalling and each vlan + uplink has its own zone.

I have all firewall rules set up so that the hosts in vlan 2-4 can e.g. ping the internet but they can't. The hosts on eth0.1 don't get NATed and they can ping the public internet.

I traced the problem down to the following: When I tcpdump on eth2 I see the NATed package going out and the reply comming in followed by a ICMP port unreachable send out. When I add LOG entries into mangle/PREROUTING and nat/PREROUTING I see the reply package come by the End of mangle/PREROUTING but not the beginning of nat/PREROUTING. I was not able to find out what motivates the kernel to reject the package between these two chains. I found multiple Variation of the iptables flow (e.g. on wikipedia) and they all state nothing between these chains.

Can someone tell me what might reject these packages?

Answer 1

I found the solution.

First I did not read the linked image correctly. It clearly states ' “nat” table only consulted for “NEW” connections'. So that's why I was not seeing the return packages in nat/PREROUTING.

After that I followed the traffic and found that I did forget to add the firewall rules from the uplink zones to the internal zones.

After adding that everything worked fine.

Sorry for the Noise