do you think is possible to create a new chain, may be using a sort of trick (trough virtual interfaces, brdiges,etc) , to have extra processing just after srcnat rules (immediately after postrouting). My goal is to discover the ip used as src ip /port as applied by the src nat rules.
To clarify, before src-nat action, I have a client request to dst tcp port 80 and dst ip a.b.c.d using as private src ip x.y.z.w and src port K. how may I discover the new src ip as output of src nat action immediately before the packet leave the router using src ip x1.y1.z1.w1 and src port K1?
I had already in the past several suggestion on use other way like packet flow and accounting but this are not feasible and didn’t fit my requirements. The solution if exist needs to use firewall chains.
if it help to describe the solution , yes, think that we already know the src priavte ip/port and dst /port and we want to know the modified public src ip/port as built by src nat rule. The reqirement is that this natted src ip/port must be recorded/logged automaically by a firewall/filter/nat rule.
-Create a bridge which includes the internet connected interface.
-Change interface of the external IP to the bridge.
-Create a mangle rule in the firewall forward chain with action mark connection and passthrough
-Create a second mangle rule in the firewall forward chain which uses the connection mark to mark the packets.
-Finaly, create a log rule in the bridge output chain that’s using the packet mark.
Prepare to have a massive log, but that’s an other problem
