Grokking NAT and packet mangling in Linux

Post by theideaofcoffee » Wed, Jun 18, 2025, 4:11 PM UTC

pak9rabid wrote: post #20

theideaofcoffee wrote: post #14

Earlier quoted context omitted.

It's a pretty common, well-accepted use in the hacker lexicon. See esr's Jargon File [0] where, by some sources [1][2], it started being used in its capacity as meaning 'understanding' for forty-ish years now at this point. [0] http://www.catb.org/jargon/html/G/grok.html [1] https://books.google.com/books?id=uS4EAAAAMBAJ&pg=PA32#v=one... [2] https://en.wikipedia.org/wiki/Grok#In_computer_programmer_cu...

Also, have we all forgotten about Groklaw already?

Post by mindslight » Wed, Jun 18, 2025, 5:49 PM UTC

EvanAnderson wrote: post #8

colmmacc wrote: post #5

A significant wrinkle in how NAT works is IP fragmentation. UDP datagrams can be larger than an IP packet. When that happens the payload is split into multiple IP packets, but only the first packet has a UDP header in it. The NAT device needs to correlate these packets by looking at fragment IDs, and then rewrite the IP addresses in the headers. That alone implies a second kind of state to maintain, but it gets worse…

> It's probably the worst mistake in TCP/IP. I vote for TCP/IP lacking a session layer as being the worst mistake. We wouldn't have IP mobility issues if there'd been an explicit session layer to decouple IP from the upper layer protocols.

Post by zokier » Wed, Jun 18, 2025, 5:53 PM UTC

colmmacc wrote: post #5

A significant wrinkle in how NAT works is IP fragmentation. UDP datagrams can be larger than an IP packet. When that happens the payload is split into multiple IP packets, but only the first packet has a UDP header in it. The NAT device needs to correlate these packets by looking at fragment IDs, and then rewrite the IP addresses in the headers. That alone implies a second kind of state to maintain, but it gets worse…

Post by viveknathani_ » Wed, Jun 18, 2025, 6:15 PM UTC

gregw2 wrote: post #3

Nice writeup on the different type of NATs. I learned something, thank you! One feedback; I would use a different word ("wrangling"?) rather than "mangling" in your title. Or mention IPv6. The title use of "mangling" alone triggered flashbacks of tracking down TCP checksum corruption in low cost home routers, or bugs in OpenBSD networking stacks back when I worked on web conferencing software. I that kind of mangling…

Post by nodesocket » Wed, Jun 18, 2025, 6:21 PM UTC

    sudo iptables -t nat -A POSTROUTING -o ens5 -j MASQUERADE
    sudo iptables -F FORWARD
    sudo iptables -A FORWARD -i ens5 -m state --state RELATED,ESTABLISHED -j ACCEPT
    sudo iptables -A FORWARD -o ens5 -j ACCEPT

    sudo iptables-save | sudo tee /etc/iptables/rules.v4 > /dev/null

    cat  /dev/null
    net.ipv4.ip_forward=1
    EOF

    sudo sysctl --system