Explicit source port mapping

Explicit source port mapping

[Andreas Micklei]

Greetings,

I have an unusual (maybe?) request. I have several private IPs (192.168.x.x) 
behind a Linux gateway. All are NATed to the Internet. Now I want to 
explicitely map each private IP to a fixed source port range on the WAN 
interface of the gateway.

Example:

Connections from 192.168.42.1 are mapped to source ports 1024 - 1279
Connections from 192.168.42.2 are mapped to source ports 1280 - 1343
Connections from 192.168.42.3 are mapped to source ports 1344 - 1408
...

Quetions 1: Can netfilter do this for me?
Question 2: If not, would it be easy to implement, and can someone give a 
suggestion where I should start? - Or even better: Has someone already 
implemented this?

Sorry if my question sounds stupid. In the HOWTOs I could only find implicit 
source port mapping. Also I did not find a search interface for the 
mailinglist. So if this question is already answered, pointers are 
appreciated.

regards,
Andreas Micklei

Re: Explicit source port mapping

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 1254 bytes --]

Hi,

I've never heard about such a feature.

Just a simple question :
	Why do you want to do this ?

BR,

Le mercredi 01 novembre 2006 à 16:24 +0100, Andreas Micklei a écrit :
> Greetings,
> 
> I have an unusual (maybe?) request. I have several private IPs (192.168.x.x) 
> behind a Linux gateway. All are NATed to the Internet. Now I want to 
> explicitely map each private IP to a fixed source port range on the WAN 
> interface of the gateway.
> 
> Example:
> 
> Connections from 192.168.42.1 are mapped to source ports 1024 - 1279
> Connections from 192.168.42.2 are mapped to source ports 1280 - 1343
> Connections from 192.168.42.3 are mapped to source ports 1344 - 1408
> ...
> 
> Quetions 1: Can netfilter do this for me?
> Question 2: If not, would it be easy to implement, and can someone give a 
> suggestion where I should start? - Or even better: Has someone already 
> implemented this?
> 
> Sorry if my question sounds stupid. In the HOWTOs I could only find implicit 
> source port mapping. Also I did not find a search interface for the 
> mailinglist. So if this question is already answered, pointers are 
> appreciated.
> 
> regards,
> Andreas Micklei
> 
> 
-- 
Eric Leblond <eric@inl.fr>
INL

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Explicit source port mapping

[Andreas Micklei]

Am Mittwoch, 1. November 2006 16:48 schrieben Sie:
> I've never heard about such a feature.
>
> Just a simple question :
> 	Why do you want to do this ?

We are deploying netfilter in a research project for a customer. He wants to 
be able to distinguish natted hosts on the WAN side for traceability.

Just don't ask further. ;-)

So if no one has ever implemented that: Where do I start? Where is the 
implicit source port mapping done (the one to avoid clashes) and can I hook 
into this mechnism with a kernel module, or should I modify the existing 
kernel code (which I have not looked at -  yet)?

> BR,
>
> Le mercredi 01 novembre 2006 à 16:24 +0100, Andreas Micklei a écrit :
> > Greetings,
> >
> > I have an unusual (maybe?) request. I have several private IPs
> > (192.168.x.x) behind a Linux gateway. All are NATed to the Internet. Now
> > I want to explicitely map each private IP to a fixed source port range on
> > the WAN interface of the gateway.
> >
> > Example:
> >
> > Connections from 192.168.42.1 are mapped to source ports 1024 - 1279
> > Connections from 192.168.42.2 are mapped to source ports 1280 - 1343
> > Connections from 192.168.42.3 are mapped to source ports 1344 - 1408
> > ...
> >
> > Quetions 1: Can netfilter do this for me?
> > Question 2: If not, would it be easy to implement, and can someone give a
> > suggestion where I should start? - Or even better: Has someone already
> > implemented this?
> >
> > Sorry if my question sounds stupid. In the HOWTOs I could only find
> > implicit source port mapping. Also I did not find a search interface for
> > the mailinglist. So if this question is already answered, pointers are
> > appreciated.
> >
> > regards,
> > Andreas Micklei

RE: Explicit source port mapping

[Frank Bulk]

Sure, that can be done.  Look at this:
http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html#ss6.1 
in detail.  Specifically, the :1-1023 at the end of the POSTROUTING command.

Regards,

Frank

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Andreas Micklei
Sent: Wednesday, November 01, 2006 9:24 AM
To: netfilter@lists.netfilter.org
Subject: Explicit source port mapping

Greetings,

I have an unusual (maybe?) request. I have several private IPs (192.168.x.x)

behind a Linux gateway. All are NATed to the Internet. Now I want to 
explicitely map each private IP to a fixed source port range on the WAN 
interface of the gateway.

Example:

Connections from 192.168.42.1 are mapped to source ports 1024 - 1279
Connections from 192.168.42.2 are mapped to source ports 1280 - 1343
Connections from 192.168.42.3 are mapped to source ports 1344 - 1408
...

Quetions 1: Can netfilter do this for me?
Question 2: If not, would it be easy to implement, and can someone give a 
suggestion where I should start? - Or even better: Has someone already 
implemented this?

Sorry if my question sounds stupid. In the HOWTOs I could only find implicit

source port mapping. Also I did not find a search interface for the 
mailinglist. So if this question is already answered, pointers are 
appreciated.

regards,
Andreas Micklei

Re: Explicit source port mapping

[Andreas Micklei]

Am Mittwoch, 1. November 2006 17:02 schrieb Frank Bulk:
> Sure, that can be done.  Look at this:
> http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html#ss6.1
> in detail.  Specifically, the :1-1023 at the end of the POSTROUTING
> command.

BINGO!

Thanks, I must have overlooked this. *slap on forehead*

regards,
Andreas Micklei