# 2.6.31 iptables ignores reply at interf. SNAT+VLAN (SOLVED)

## luispa

Hi, I have a bit complex iptables+nat+mangle+vlan's setup within my box working perfectly with 2.6.30. However, If I boot 2.6.31 then one of the capabilities stops working. 

Replay packet's are silently ignored "only" at the interface doing SNAT+vlan. Rest of actions: iptables, nat, mangle's, policy based routing and NAT (no vlan) are working perfectly. To simplify the problem, here is the relevant setup and config:

```
 

["uid 1500" wget http://99.0.0.9]

     |

LOCALHOST(10.0.0.1)vlan400  ==== (10.0.0.2)ROUTER ==== "MyPrivate" host(99.0.0.9)

```

```
 

# echo "100 MyPrivate" >> /etc/iproute2/rt_tables

# ip route add 10.0.0.1/24 dev vlan400 table MyPrivate

# ip route add 99.0.0.0/8 via 10.0.0.2 table MyPrivate

# iptables -A OUTPUT -t mangle -m owner --uid-owner 1500 -j MARK --set-mark 1500

# ip rule add fwmark 1500 table MyPrivate

# iptables -t nat -A POSTROUTING -o vlan400 -j SNAT --to-source 10.0.0.1

# echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter

```

With this setup, all network traffic originated by user id 1500 should check first the "MyPrivate" table and if destination is 99.0.0.9 then send it out through vlan400 interface and perform source NAT. 

Starts ok, traffic goes out on "vlan400" and remote host reply is correct, but then it stops. My localhost is not sending the last ACK, looks like it never sees the reply (SYN, ACK)

```

$ (running uid 1500)

$ wget http://99.0.0.9

:

10.0.0.1 SYN -->

                   <-- SYN, ACK 99.0.0.9

```

I've made lots of tests, googled, etc. but couldn't find anything, only some references to some issues corrected on 2.6.31 regarding NAT and connection tracking, but none similar to mine. 

Anybody knows if something important has been changed with 2.6.31? any idea?

Thanks in advance, 

LuisLast edited by luispa on Mon Nov 16, 2009 8:39 pm; edited 1 time in total

----------

## luispa

Answering myself, after hours troubleshooting this, solution is simple, as always  :Smile: 

I had rp_filter disabled for all interfaces: 

```
 echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
```

Just doing the same specifically in the SNATed interface, the problem disappeared.

```
 echo 0 > /proc/sys/net/ipv4/conf/vlan400/rp_filter
```

Why it's not needed under 2.6.30 is something I don't know, under 2.6.31 now works adding the last command.

Luis

----------

