Subject: Re: stateless nat *please* tell me how I'm supposed to use it

From: Erik Slagter <[email-masked]>
Date: Mon, 23 May 2011 14:12:36 +0200

Hi everybody,

I am a little disappointed that nobody can or wants to tell me how
stateless nat is supposed to be used. As no other documentation exists
on this subject, this gives the impression this knowledge is a secret?

For people that run into the same problem, I can tell that I've found
the solution, with help from Rodrigo Partearroyo González. The key is
that packet munging on this level is only useful if performed before
routing and as the (normal) egress qdisc is called only just before the
handing the packet to the device, the stateless nat is performed by the
"ingress" qdisc and so the nat action / filter needs to be attached to
the, to be added, tc ingress qdisc. And then it works, e.g.

tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol ip prio 10 u32 match ip src
1.2.3.4 action nat egress 1.2.3.4/32 5.6.7.8

I guess the "pedit" and related actions work alike.

Now I am still wondering what the "tc action" syntax is for.

Erik Slagter.