diff --git a/hooks b/hooks index 8ad3087..08da5cc 100755 --- a/hooks +++ b/hooks @@ -15,7 +15,7 @@ import re import subprocess import sys -# python 2.6 support +# python 2.6 support if "check_output" not in dir( subprocess ): def f(*popenargs, **kwargs): if 'stdout' in kwargs: @@ -186,6 +186,8 @@ def insert_chains(action, dnat_chain, snat_chain, fwd_chain, public_ip, private_ "OUTPUT", "-d", public_ip, "-j", dnat_chain]) subprocess.call([IPTABLES_BINARY, "-t", "nat", action, "PREROUTING", "-d", public_ip, "-j", dnat_chain]) + subprocess.call([IPTABLES_BINARY, "-t", "nat", action, "POSTROUTING", + "-s", private_ip, "-p", "all", "-j", "SNAT", "--to-source", public_ip]) subprocess.call([IPTABLES_BINARY, "-t", "nat", action, "POSTROUTING", "-s", private_ip, "-d", private_ip, "-j", snat_chain]) subprocess.call([IPTABLES_BINARY, "-t", "filter", action, diff --git a/test_qemu.py b/test_qemu.py index 54a2836..af89923 100755 --- a/test_qemu.py +++ b/test_qemu.py @@ -72,6 +72,7 @@ def test_setup(self): -t filter -A FWD-test -p tcp -d 127.0.0.1 --dport 443 -j ACCEPT -o virbr0 -t nat -I OUTPUT -d 192.168.1.1 -j DNAT-test -t nat -I PREROUTING -d 192.168.1.1 -j DNAT-test + -t nat -I POSTROUTING -s 127.0.0.1 -p all -j SNAT --to-source 192.168.1.1 -t nat -I POSTROUTING -s 127.0.0.1 -d 127.0.0.1 -j SNAT-test -t filter -I FORWARD -d 127.0.0.1 -j FWD-test """) @@ -100,6 +101,7 @@ def test_teardown(self): expected_output = self.dedent(""" -t nat -D OUTPUT -d 192.168.1.1 -j DNAT-test -t nat -D PREROUTING -d 192.168.1.1 -j DNAT-test + -t nat -D POSTROUTING -s 127.0.0.1 -p all -j SNAT --to-source 192.168.1.1 -t nat -D POSTROUTING -s 127.0.0.1 -d 127.0.0.1 -j SNAT-test -t filter -D FORWARD -d 127.0.0.1 -j FWD-test -t nat -F DNAT-test