diff --git a/build_num b/build_num index 06d9e6080..e0c50bd4a 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 3236 +#define BUILD_NUM 3237 diff --git a/doc/ChangeLog b/doc/ChangeLog index 17aaf585a..5ab096772 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -8,6 +8,12 @@ will use PREROUTING and POSTROUTING in single compile mode but issue a warning. + * NATCompiler_ipt.cpp (localNATRule::processNext): see #1685 + "iptables redirecting NAT rules in the OUTPUT chain". This fix + makes it possible to create iptables NAT rule with target REDIRECT + in the OUTPUT chain. The rule should have firewall object in OSrc + and TDst rule elements. + * NATCompiler_PrintRule.cpp (PrintRule::processNext): fixed #1693 SF bug 3048516 "NAT rule with 'Use SNAT instead MASQ' doesn't work". NAT rule using combination of the option "Use SNAT instead diff --git a/src/iptlib/NATCompiler_ipt.cpp b/src/iptlib/NATCompiler_ipt.cpp index cdc9a2d55..d8ebcd0a5 100644 --- a/src/iptlib/NATCompiler_ipt.cpp +++ b/src/iptlib/NATCompiler_ipt.cpp @@ -2064,7 +2064,7 @@ bool NATCompiler_ipt::localNATRule::processNext() { case NATRule::DNAT: case NATRule::DNetnat: - + case NATRule::Redirect: /* it should not be necessary to do anything if rule type is NONAT * since splitNONATRule takes care of NONAT rules * diff --git a/test/ipt/objects-for-regression-tests.fwb b/test/ipt/objects-for-regression-tests.fwb index b3b92fd1e..92717570e 100644 --- a/test/ipt/objects-for-regression-tests.fwb +++ b/test/ipt/objects-for-regression-tests.fwb @@ -1,6 +1,6 @@ - + @@ -4640,6 +4640,7 @@ + @@ -8138,7 +8139,7 @@ - + @@ -9235,6 +9236,27 @@ + + + + + + + + + + + + + + + + + + + + +