Port Forwards shouldn't masquerade

[jtrott]

I'm running R069 but this has been an issue from the first day.
I have several port forwards from the internet to internal hosts, I set these up in the GUI under the port forwarding section.
They work, the problem is that they masquerade the incoming traffic behind the LAN IP of the Almond+.
This causes issues for SMTP as the mail server can't see the original source IP of the connection, so can't apply blacklisting or other filtering rules properly.
The iptables rule that causes the problem is this one:

Chain zone_lan_nat (1 references)
target     prot opt source               destination         
MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0           

The fix I have found is to insert the following rule:

Chain zone_lan_nat (1 references)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0

Can anyone tell me why incoming traffic is being masqueraded and if there is any good reason for this practice? Also, is there some way other than hacking the firewall scripts to turn this behaviour off?
Masquerading outgoing traffic is neccessary and good, but not incoming traffic.

Thanks,
JT

[j8048188]

This might fix my VPN server issues. I'll give it a try and report back.

[j8048188]

Hey jtrott, how did you add in that rule?

[jtrott]

I added the rule with the following command:

/usr/sbin/iptables -t nat -I zone_lan_nat -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT

You can see if it worked with the following command:

/usr/sbin/iptables -t nat -L -n

To try and make it permanent, I added the command into the /lib/firewa/core.sh file on the 54th line before the "}" of the "fw_start() { "  block.
I haven't had a chance to reboot and test the changes yet.

[jtrott]

A better fix is probably to switch to the OpenWRT interface, edit the port forward rule and turn off NAT Reflection.
That also fixes the problem and doesn't require hacking any firewall rules files manually.

[jtrott]

Except, after upgrading to R70, the problem is back - and I still have the Enable NAT Loopback option disabled in OpenWRT.