how to redirect certain IPs to specific url

how to redirect certain IPs to specific url

[Askar Ali Khan]

hi 
got a very simple question, i want to redirect certain IPs(clients)
request to a specific URL (ip)?
and also later on how to Flush the specific rule from the the chain as
-A will append it on the bottom, how  i will delete it ?

thanks

Re: how to redirect certain IPs to specific url

[Antony Stone]

On Wednesday 30 June 2004 8:44 am, Askar Ali Khan wrote:

> hi
> got a very simple question, i want to redirect certain IPs(clients)
> request to a specific URL (ip)?

So long as you keep in mind two things:

1. An IP address is not the same thing as a URL (firstly, a server on one IP 
address may handle many different domains' websites, secondly a big domain 
such as Amazon, Microsoft, Yahoo may resolve to multiple IP addresses, 
thirdly an IP address (even if unique to a domain) cannot specify a path or 
filename which would follow the first / after the domain in a URL).

2. Netfilter works at OSI layers 3/4 (IP addresses and TCP/UDP port numbers), 
whereas HTTP works at layer 7 (URLs, hyperlinks and meaningful content).

Provided both the above are acceptable, and what you want to do is to redirect 
certain source IP addresses when accessing TCP port 80 to a different 
destination address, then you can do this:

iptables -A PREROUTING -t nat -p tcp --dport 80 -s a.b.c.d -j DNAT --to 
w.x.y.z

where a.b.c.d is the IP address of the client you want to redirect and w.x.y.z 
is where you want them redirected to.   If you want to do it only when they 
try to access a specific destination address (so other destinations are not 
redirected), simply add a "-d p.q.r.s" into the rule above, where p.q.r.s is 
the destination address you want them not to be able to reach.

If this is not what you want, and you do indeed need to do stuff at OSI layer 
7, working on HTTP rather than TCP and IP, you should probably look into 
http://www.squid-cache.org

> and also later on how to Flush the specific rule from the the chain as
> -A will append it on the bottom, how  i will delete it ?

Repeat the rule but with -D instead of -A

Regards,

Antony.

-- 
There's no such thing as bad weather - only the wrong clothes.

 - Billy Connolly

                                                     Please reply to the list;
                                                           please don't CC me.

Re: how to redirect certain IPs to specific url

[Askar Ali Khan]

thanks im learn lot of things from your contribution to iptables
mailing lists :)


On Wed, 30 Jun 2004 09:31:16 +0100, Antony Stone
<antony@soft-solutions.co.uk> wrote:
> 
> On Wednesday 30 June 2004 8:44 am, Askar Ali Khan wrote:
> 
> > hi
> > got a very simple question, i want to redirect certain IPs(clients)
> > request to a specific URL (ip)?
> 
> So long as you keep in mind two things:
> 
> 1. An IP address is not the same thing as a URL (firstly, a server on one IP
> address may handle many different domains' websites, secondly a big domain
> such as Amazon, Microsoft, Yahoo may resolve to multiple IP addresses,
> thirdly an IP address (even if unique to a domain) cannot specify a path or
> filename which would follow the first / after the domain in a URL).
> 
> 2. Netfilter works at OSI layers 3/4 (IP addresses and TCP/UDP port numbers),
> whereas HTTP works at layer 7 (URLs, hyperlinks and meaningful content).
> 
> Provided both the above are acceptable, and what you want to do is to redirect
> certain source IP addresses when accessing TCP port 80 to a different
> destination address, then you can do this:
> 
> iptables -A PREROUTING -t nat -p tcp --dport 80 -s a.b.c.d -j DNAT --to
> w.x.y.z

may i have to replace w.x.y.z with the IP of domain or simply
www.abc.com will work?

> 
> where a.b.c.d is the IP address of the client you want to redirect and w.x.y.z
> is where you want them redirected to.   If you want to do it only when they
> try to access a specific destination address (so other destinations are not
> redirected), simply add a "-d p.q.r.s" into the rule above, where p.q.r.s is
> the destination address you want them not to be able to reach.
> 
> If this is not what you want, and you do indeed need to do stuff at OSI layer
> 7, working on HTTP rather than TCP and IP, you should probably look into
> http://www.squid-cache.org

we have firewall it redirect traffic to cache server running "squid"
:) may i put this rule on firewall machine or the cache server ?

> 
> > and also later on how to Flush the specific rule from the the chain as
> > -A will append it on the bottom, how  i will delete it ?
> 
> Repeat the rule but with -D instead of -A
> 
> Regards,
> 
> Antony.
> 
> --
> There's no such thing as bad weather - only the wrong clothes.
> 
>  - Billy Connolly
> 
>                                                      Please reply to the list;
>                                                            please don't CC me.
> 
>

Re: how to redirect certain IPs to specific url

[Antony Stone]

On Wednesday 30 June 2004 10:13 am, Askar Ali Khan wrote:

> > iptables -A PREROUTING -t nat -p tcp --dport 80 -s a.b.c.d -j DNAT --to
> > w.x.y.z
>
> may i have to replace w.x.y.z with the IP of domain or simply
> www.abc.com will work?

You can use www.abc.com, but you must remember that www.abc.com will be 
resolved to an IP address *at the time you enter the rule*, and the rule will 
then exist on your firewall with that IP address while the firewall is 
running.

Therefore if www.abc.com always resolves to one IP address, it makes no 
difference whether you enter the rule by IP or name.

If www.abc.com resolves to one IP address, but that address changes, your 
firewall wil continue to use the old IP address until you change it.

If www.abc.com resolves to more than one IP address, only one will get entered 
into the rule if you specify the name (and you would need to use multiple 
rules if you specify by IP), and therefore only some of the packets sent to 
ww.abc.com would match the rule.

> > If this is not what you want, and you do indeed need to do stuff at OSI
> > layer 7, working on HTTP rather than TCP and IP, you should probably look
> > into http://www.squid-cache.org
>
> we have firewall it redirect traffic to cache server running "squid"
>
> :) may i put this rule on firewall machine or the cache server ?

If you want to use netfilter rules, put them on the firewall.   If you want to 
do URL redirection and perhaps regular expression matching, or you want to 
make sure that www.abc.com always works in a rule, then use Squid (because 
that will do a DNS lookup of www.abc.com every time it sees it in a URL).

Regards,

Antony.

-- 
There are only 10 types of people in the world:
those who understand binary notation,
and those who don't.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: how to redirect certain IPs to specific url

[James A. Pattie]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Antony Stone wrote:

| If www.abc.com resolves to more than one IP address, only one will get entered
| into the rule if you specify the name (and you would need to use multiple
| rules if you specify by IP), and therefore only some of the packets sent to
| ww.abc.com would match the rule.
|

I just tested and if you say use www.yahoo.com, which resolves to multiple
entries, you get that many iptables rules generated for each unique IP that
www.yahoo.com resolves to.  I've been relying on this feature for a long time. :)


- --
James A. Pattie
james@pcxperience.com

Linux -- SysAdmin / Programmer
Xperience, Inc.
http://www.pcxperience.com/
http://www.xperienceinc.com/
http://www.pcxperience.org/

GPG Key Available at http://www.pcxperience.com/gpgkeys/james.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFA4tjXtUXjwPIRLVERAvFyAKCe3AYePy69ry/RPYkfs1saIUqIRgCgttVp
HM6SXxZo+/hXeN/Hs7CnrR8=
=qy1L
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

Re: how to redirect certain IPs to specific url

[Ian Holsman]

Hi.
If your running a apache webserver you can do this via re-write rules

check out http://httpd.apache.org/docs-2.0/mod/mod_rewrite.html

something like
rewriteengine on
RewriteCond %{REMOTE_HOST}  ^host1.*  [OR]
RewriteCond %{REMOTE_HOST}  ^host2.*  [OR]
RewriteCond %{REMOTE_HOST}  ^host3.*
RewriteRule ...some special stuff for any of these hosts...

On Wed, 30 Jun 2004 12:44:09 +0500, Askar Ali Khan <askarali@gmail.com> wrote:
> 
> hi
> got a very simple question, i want to redirect certain IPs(clients)
> request to a specific URL (ip)?
> and also later on how to Flush the specific rule from the the chain as
> -A will append it on the bottom, how  i will delete it ?
> 
> thanks
> 
>