Does IPTables have a 1:1 port-forwarding capability for a DNAT port-range ?

Does IPTables have a 1:1 port-forwarding capability for a DNAT port-range ?

[Ranjeet Shetye]

Reposting without all the MIME attachments - my apologies for the crud
from Outlook. Here's my question again in plaintext.

DNAT:
 
Is it possible to have a SINGLE (DNAT?) rule that will let me do 1:1
port-forwarding over a range of ports while doing Destination NAT.
 
e.g. Any incoming connections to 64.1.0.20:100-101 need to be mapped to
172.16.0.100:200-201 for the TCP protocol.
 
such that a connection to port 101 will ALWAYS map to port 201 and a
connection to port 100 will ALWAYS map to port 200.
 
Under current DNAT port range scenario, the connection goes to the
lowest port that is free e.g. a port 101 connection will be DNATt'ed to
port 200 if port 200 is free.
 
The reason for wanting a 1:1 rule is for X windows and other fat port
ranges. Dont want hundreds of rules in there if one can do the job. Can
IPTables do it ? If so how ? If not, I guess I'll have to get in touch
with the developers for tips on a good starting point.
 
Thanks in advance,
Ranjeet Shetye.

Query.... redirecting traffic

[Paul Gibson]

Hello,

	I am wondering if netfilter can do the following.....

http connection comes in on 10.10.10.10 port 80, can iptables then redirect
this to go to 192.168.1.1 port 12345 & also allow the returning data to go
back the opposite way ???

We are currently using "redir" to do it and are having some porblems with it
due to an application we run.

TIA

Paul.

Re: Query.... redirecting traffic

[Sander Sneekes]

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE

iptables -A FORWARD -p tcp --dport 80 -d 192.168.1.1 -j ACCEPT
iptables -A PREROUTING -t nat -p tcp --dport 80 -d 10.10.10.10 -j DNAT
--to 
192.168.1.1:12345

On Fri, 2002-12-13 at 10:02, Paul Gibson wrote:
> Hello,
> 
> 	I am wondering if netfilter can do the following.....
> 
> http connection comes in on 10.10.10.10 port 80, can iptables then redirect
> this to go to 192.168.1.1 port 12345 & also allow the returning data to go
> back the opposite way ???
> 
> We are currently using "redir" to do it and are having some porblems with it
> due to an application we run.
> 
> TIA
> 
> Paul.
-- 
Sander Sneekes
sander@dmdsecure.com

--
Never argue with an idiot. They drag you down to their level, then beat
you with experience.

RE: Query.... redirecting traffic

[Paul Gibson]

Wow

Thanks very much for all the replies.....  and examples too :)
Looks like I can get rid of the dodgy redir.

thanks again! :)

-----Original Message-----
From: Sander Sneekes [mailto:sander@dmdsecure.com]
Sent: Friday, 13 December 2002 8:47 PM
To: paul.gibson@subspace.net.au
Cc: Netfilter
Subject: Re: Query.... redirecting traffic


iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE

iptables -A FORWARD -p tcp --dport 80 -d 192.168.1.1 -j ACCEPT
iptables -A PREROUTING -t nat -p tcp --dport 80 -d 10.10.10.10 -j DNAT
--to
192.168.1.1:12345

On Fri, 2002-12-13 at 10:02, Paul Gibson wrote:
> Hello,
>
> 	I am wondering if netfilter can do the following.....
>
> http connection comes in on 10.10.10.10 port 80, can iptables then
redirect
> this to go to 192.168.1.1 port 12345 & also allow the returning data to go
> back the opposite way ???
>
> We are currently using "redir" to do it and are having some porblems with
it
> due to an application we run.
>
> TIA
>
> Paul.
--
Sander Sneekes
sander@dmdsecure.com

--
Never argue with an idiot. They drag you down to their level, then beat
you with experience.

Re: Does IPTables have a 1:1 port-forwarding capability for a DNAT port-range ?

[Andrea Rossato]

Ranjeet Shetye wrote:
> The reason for wanting a 1:1 rule is for X windows and other fat port
> ranges. Dont want hundreds of rules in there if one can do the job. Can
> IPTables do it ? If so how ? If not, I guess I'll have to get in touch
> with the developers for tips on a good starting point.

I believe that the only way is to hack nat code.
I will start looking in
net/ipv4/netfilter/ip_nat_core.c
and the function manip_pkt that, as far as I understand, is actually
writing the NATed packet
andrea

RE: Does IPTables have a 1:1 port-forwarding capability for a DNAT port-range ?

[Ranjeet Shetye]

Hi Andrea,

I was hoping that the answer would be "Yes, IPTables can do it", but I
think you are right. As a matter of fact, I have been looking into the
NetFilter code for the last couple of days and I was hoping that I
didn't need to hack the kernel code (cos its not documented). But it
looks like I will have to.

Anyways, I will take my query to the developer-mailing list and post a
reply here once everything is sorted out. In the meantime if anyone has
an architectural overview of Netfilter, one that maps out the
interactions between the various components and layers, I'd really
really like to get my hands on it!

Thanks for your help, Andrea.

Ranjeet Shetye
Senior Software Engineer
Zultys Technologies
771 Vaqueros Avenue
Sunnyvale  CA  94085
USA
Ranjeet.Shetye@Zultys.com
http://www.zultys.com/

 


> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org 
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of 
> Andrea Rossato
> Sent: Friday, December 13, 2002 4:03 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Does IPTables have a 1:1 port-forwarding 
> capability for a DNAT port-range ?
> 
> 
> Ranjeet Shetye wrote:
> > The reason for wanting a 1:1 rule is for X windows and 
> other fat port 
> > ranges. Dont want hundreds of rules in there if one can do the job. 
> > Can IPTables do it ? If so how ? If not, I guess I'll have 
> to get in 
> > touch with the developers for tips on a good starting point.
> 
> I believe that the only way is to hack nat code.
> I will start looking in
> net/ipv4/netfilter/ip_nat_core.c
> and the function manip_pkt that, as far as I understand, is 
> actually writing the NATed packet andrea
> 
> 

Does IPTables have a 1:1 port-forwarding capability for a DNAT port-range ?

[Ranjeet Shetye]

[-- Attachment #1.1: Type: text/plain, Size: 865 bytes --]

 
DNAT:
 
Is it possible to have a SINGLE (DNAT?) rule that will let me do 1:1
port-forwarding over a range of ports while doing Destination NAT.
 
e.g. Any incoming connections to 64.1.0.20:100-101 need to be mapped to
172.16.0.100:200-201 for the TCP protocol.
 
such that a connection to port 101 will ALWAYS map to port 201 and a
connection to port 100 will ALWAYS map to port 200.
 
Under current DNAT port range scenario, the connection goes to the
lowest port that is free e.g. a port 101 connection will be DNATt'ed to
port 200 if port 200 is free.
 
The reason for wanting a 1:1 rule is for X windows and other fat port
ranges. Dont want hundreds of rules in there if one can do the job. Can
IPTables do it ? If so how ? If not, I guess I'll have to get in touch
with the developers for tips on a good starting point.
 
Thanks in advance,
Ranjeet Shetye



[-- Attachment #1.2: Type: text/html, Size: 2123 bytes --]

[-- Attachment #2: Leaves Bkgrd.jpg --]
[-- Type: image/jpeg, Size: 4389 bytes --]