[Cerowrt-users] no xt_TRACE in kernel

[Cerowrt-users] no xt_TRACE in kernel

[Marc MERLIN]

Since it's a router distrib for advanced routing, would it be possible to
add more modules in the kernel build?

For instance, I have to debug why a packet forward/rewrite isn't working,
and I can't easily:
root@wireless:~# iptables -t raw -A PREROUTING -p tcp --dport 10443 -j TRACE
iptables v1.4.12.2: Couldn't load target `TRACE':No such file or directory

More generally, I have his:
root@wireless:~# iptables -t nat -L -v -n 
Chain PREROUTING (policy ACCEPT 4067K packets, 760M bytes)
 pkts bytes target     prot opt in     out     source               destination         
4068K  760M prerouting_rule  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
 704K  190M zone_wan_prerouting  all  --  ge00   *       0.0.0.0/0            0.0.0.0/0           
    0     0 zone_guest_prerouting  all  --  gw00   *       0.0.0.0/0            0.0.0.0/0           
    0     0 zone_guest_prerouting  all  --  gw10   *       0.0.0.0/0            0.0.0.0/0           
3364K  570M zone_lan_prerouting  all  --  br-lan *       0.0.0.0/0            0.0.0.0/0           


Chain zone_lan_prerouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   29  1740 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10443 to:192.168.205.72:443
3364K  570M prerouting_lan  all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain zone_wan_prerouting (1 references)
 pkts bytes target     prot opt in     out     source               destination         
   14   840 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10443 to:192.168.205.72:443
 704K  190M prerouting_wan  all  --  *      *       0.0.0.0/0            0.0.0.0/0    

telnet wan-ip 10443 works if the packet comes from the outside and arrieves on ge00.

But if I do this from the lan, it shoul darrive on br-lan and be re-forwarded out 
on the br-lan interface, but that's not working.

Being able to do packet tracing as described here
http://backreference.org/2010/06/11/iptables-debugging/

Would have made my job much easier :)

Thanks,
Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/  

Re: [Cerowrt-users] no xt_TRACE in kernel

[Marc MERLIN]

On Mon, Mar 04, 2013 at 09:01:11PM -0800, Marc MERLIN wrote:
> But if I do this from the lan, it shoul darrive on br-lan and be re-forwarded out 
> on the br-lan interface, but that's not working.

I forgot to say that the answer to this is to use SNAT, something like
iptables -t nat -I POSTROUTING 1 -d dest -p tcp --dport 443 -s 192.168.1.1/24 -j SNAT --to 192.168.1.254

but my question was more about xt_TRACE than fixing this specific problem :)

Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/