* hello german speaking?
2004-04-20 16:33 martians and portforwarding to 127.0.0.1 udo
@ 2004-04-20 16:42 ` marc manthey
2004-04-20 16:59 ` Antony Stone
2004-04-20 16:43 ` martians and portforwarding to 127.0.0.1 David Cannings
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: marc manthey @ 2004-04-20 16:42 UTC (permalink / raw)
To: netfilter
hallo
kennst sich hier jemand mit CUSEEME aus oder hat schon mal einer
einen REFLECTOR
server aufgesetzt oder kennt die problematik mit den ports?
wäre sehr dankbar
gruss
aus köln
--
Marc Manthey (C.V.O.)
Hildeboldplatz 1a
D – 50672 KÖLN
web:http://www.let.de
mail:marc@electric-circus.de
Mobile:+49(0)177-3415481
--
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: hello german speaking?
2004-04-20 16:42 ` hello german speaking? marc manthey
@ 2004-04-20 16:59 ` Antony Stone
0 siblings, 0 replies; 6+ messages in thread
From: Antony Stone @ 2004-04-20 16:59 UTC (permalink / raw)
To: netfilter
On Tuesday 20 April 2004 5:42 pm, marc manthey wrote:
> hallo
>
> kennst sich hier jemand mit CUSEEME aus oder hat schon mal einer
> einen REFLECTOR
> server aufgesetzt oder kennt die problematik mit den ports?
Ich kann ein bisschen Deutsch sprechen, ja, aber ich kann nicht mit CUSEEME
hilfen :(
Vielleicht kann jemand anderes auf Englisch hilfen....
And now, in case anyone else can help this guy, he's asking whether anyone
here knows how to set up a CUSEEME reflector, or whether there is some
problem with the ports it uses (presumably in relation to netfilter rules,
although he doesn't actually ask this).
I don't know the answer, I just thought a translation of the question might
help to find someone who does?
Regards,
Antony.
--
It is also possible that putting the birds in a laboratory setting
inadvertently renders them relatively incompetent.
- Daniel C Dennet
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: martians and portforwarding to 127.0.0.1
2004-04-20 16:33 martians and portforwarding to 127.0.0.1 udo
2004-04-20 16:42 ` hello german speaking? marc manthey
@ 2004-04-20 16:43 ` David Cannings
2004-04-20 17:00 ` Antony Stone
2004-04-20 17:20 ` Cedric Blancher
3 siblings, 0 replies; 6+ messages in thread
From: David Cannings @ 2004-04-20 16:43 UTC (permalink / raw)
To: netfilter
On Tuesday 20 April 2004 17:33, udo wrote:
> $path_iptables -t nat -A PREROUTING -p tcp -i $ext_if
> -s 0/0 -d $ext_ip --dport 222 -j DNAT --to
> 127.0.0.1:22
> How can I make the sshd (attached to loopback) work
> without `martian destination` messages for packets
> destined for port 22?
Please see my lengthly post about this from last month. Due to the way
the martian checking code in the kernel is written, I do not think this
is possible.
http://lists.netfilter.org/pipermail/netfilter/2004-March/051615.html
Hopefully somebody can prove this wrong, I hope that post helps you.
David
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: martians and portforwarding to 127.0.0.1
2004-04-20 16:33 martians and portforwarding to 127.0.0.1 udo
2004-04-20 16:42 ` hello german speaking? marc manthey
2004-04-20 16:43 ` martians and portforwarding to 127.0.0.1 David Cannings
@ 2004-04-20 17:00 ` Antony Stone
2004-04-20 17:20 ` Cedric Blancher
3 siblings, 0 replies; 6+ messages in thread
From: Antony Stone @ 2004-04-20 17:00 UTC (permalink / raw)
To: netfilter
On Tuesday 20 April 2004 5:33 pm, udo wrote:
> Hello,
>
> To be able to run sshd from an unpriviliged port I
> want to let sshd listen to just the lo (12.0.0.1)
> interface, port 2222 and forward connections to port
> 22 on my internet and LAN interfaces to 127.0.0.1:22.
I find it hard to understand quite what you mean here.
1. Why would you want to use ssh to connect to the same machine (which is all
you can do on the loopback interface)?
2. If you have sshd listening on port 2222, why not just ssh to port 2222?
3. You use the word "forward" in a way which confuses me - are you talking
about one machine here, or redirecting the packets to some other machine on
the Internet or your LAN? (In which case, address 127.0.0.1 is probably not
approporiate).
> To enable this I use something like:
>
> $path_iptables -t nat -A PREROUTING -p tcp -i $ext_if
> -s 0/0 -d $ext_ip --dport 222 -j DNAT --to
> 127.0.0.1:22
> $path_iptables -t nat -A PREROUTING -p tcp -i
> $local_if -s $local_net -d $local_ip --dport 222 -j
> DNAT --to 127.0.0.1:22
I think those rules need to be in the OUTPUT chain nat table.
> $path_iptables -A FORWARD -p tcp -i $ext_if -o lo -s
> 0/0 -d 127.0.0.1 --dport 22 -m state --state NEW -j
> ACCEPT
Nothing is going to come in the $ext_if addressed to 127.0.0.1 and destined
for interface lo.
Packets *to* lo come *from* lo.
> $path_iptables -A FORWARD -p tcp -i $local_if -o lo -s
> $local_net -d 127.0.0.1 --dport 22 -m state --state
> NEW -j ACCEPT
>
> (for a test I enabled port 222 -> 127.0.0.1:22)
>
> This makes the following message appear in the log:
>
> blabla kernel: martian destination 127.0.0.1 from
> x.y.z.q, dev ppp0
Yes. The loopback address is not a valid destination address for packets
coming from outside the machine.
> How can I make the sshd (attached to loopback) work
> without `martian destination` messages for packets
> destined for port 22?
Why attach sshd to loopback only? If you want to accept connections from
other machines (which it appears that you do), then allow sshd to accept
connections from ppp0, albeit on a high port number, and that should solve
your problem?
Or have I misunderstood what you are trying to do?
Regards,
Antony.
--
The idea that Bill Gates appeared like a knight in shining armour to lead all
customers out of a mire of technological chaos neatly ignores the fact that
it was he who, by peddling second-rate technology, led them into it in the
first place.
- Douglas Adams in The Guardian, 25th August 1995
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: martians and portforwarding to 127.0.0.1
2004-04-20 16:33 martians and portforwarding to 127.0.0.1 udo
` (2 preceding siblings ...)
2004-04-20 17:00 ` Antony Stone
@ 2004-04-20 17:20 ` Cedric Blancher
3 siblings, 0 replies; 6+ messages in thread
From: Cedric Blancher @ 2004-04-20 17:20 UTC (permalink / raw)
To: udo; +Cc: netfilter
Le mar 20/04/2004 à 18:33, udo a écrit :
> $path_iptables -t nat -A PREROUTING -p tcp -i $ext_if
> -s 0/0 -d $ext_ip --dport 222 -j DNAT --to
> 127.0.0.1:22
Something is quite wierd here. You say you want to run an unprivilieged
SSHd, so it won't be able to bind port 22... So, please rephrase if I'm
wrong, but I guess you want to redirect connections to port 22 to
127.0.0.1, port 2222. You seems very confused about what you want to
achieve, and the way you're trying to do it.
BTW, do not DNAT to 127.0.0.1.
Use REDIRECT that is designed for this very need :
iptables -t nat -A PREROUTING -p tcp -i $ext_if \
-d $ext_ip --dport 22 -j REDIRECT --to-ports 2222
Please correct me if I'm wrong. For other mistakes, see Antony's answer.
--
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!
^ permalink raw reply [flat|nested] 6+ messages in thread