How does Linux NAT a ping?
devnonsense.com
How does Linux NAT a ping?
1–10 of 108 posts
Re: How does Linux NAT a ping?
#2NAT is such a trashy abstraction. IPv4 needs to die.
Re: How does Linux NAT a ping?
#3NAT is such a trashy abstraction. IPv4 needs to die.
You'll hate CG-NAT even more then.
Re: How does Linux NAT a ping?
#4Re: How does Linux NAT a ping?
#5NAT is such a trashy abstraction. IPv4 needs to die.
You need NAT (or something else that is worse in some respects, like port forwarding) in any situation in which your subnet is given only one address upstream, even if it is an IPv6 address.
Re: How does Linux NAT a ping?
#6Good post.
Coincidently, I was struggling with Netfilter this weekend to enable transparent proxy on my OpenWRT router.
For the curious, the go-to resources for Netfilter are:
1. https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
Re: How does Linux NAT a ping?
#7It's refreshing to see a "how does" which actually drills down through layers of abstraction all the way to the source code. Nicely explained and very informative!
Re: How does Linux NAT a ping?
#8Since there is no port in ICMP, NAT doesn't have to deal with the problem of sending the ICMP echo reply back to the correct port.
ICMP echo requests have an ID, and that's effectively the same as a source port number.
Correct NAT handling of ICMP echo has to remap the ID in both directions, the same way that correct handling of UDP remaps the source port.
Reason being, if the machine behind NAT is being pinged at the same time by two different hosts, and they happen to use the same request numbers, then it is ambiguous.
Another possibility is not to rewrite the identifiers, but keep a list of remote machines associated with each ID. When there is a clashing ID, the list contains two or more entries (remote IP addresses). So then, when a reply is received from the machine behind the NAT gateway, the NAT chooses one of the entries in the list (say, the least recently added one) and sends the reply to that machine. Then removes the entry.
Re: How does Linux NAT a ping?
#9NAT is such a trashy abstraction. IPv4 needs to die.
You need NAT (or something else that is worse in some respects, like port forwarding) in any situation in which your subnet is given only one address upstream, even if it is an IPv6 address.
If your ISP doesn't do PD with v6, their implementation sucks. Even my crappy 6rd setup from CenturyLink gives me iirc an entire /48.