iptables -j REDIRECT

iptables -j REDIRECT

[Сергеев Сергей Николаевич]

Hello!
I'm using iptables v1.2.11 with kernel 2.4.26 at RH8.
Also there is squid-cache 2.5.STABLE1 listening at port 3128.

They works as transparent proxy gateway for small office:

[]# iptables -A PREROUTING -t nat -i LAN -p tcp --dport 80 -j REDIRECT --to-port 3128

to manage and account data going to 80 port I did something like this:
[]# iptables -A PREROUTING -t mangle -i LAN -p tcp --dport 80 -j LOG

the question is:
how can I manage packets incoming from 80 port to my LAN?
All chains and tables(OUTPUT:mangle,nat,filter and POSTROUTING:mangle,nat) shows that one go from local_ip_of_gateway:3128.
But tcpdump started at LAN interface shows that packets go from real ip addresses and src_port 80....
In what chain and table netfilter replaces SRC_ip & SRC_port back by real?

Thank you!
-- 
Best regards,
 Sergeyev , Moscow RU                          mailto:serg@dinfo.ru

Re: iptables -j REDIRECT

[Cedric Blancher]

Le lun 05/07/2004 à 23:08, Сергеев Сергей Николаевич a écrit :
> how can I manage packets incoming from 80 port to my LAN?
> All chains and tables(OUTPUT:mangle,nat,filter and
> POSTROUTING:mangle,nat) shows that one go from
> local_ip_of_gateway:3128.
> But tcpdump started at LAN interface shows that packets go from real
> ip addresses and src_port 80....
> In what chain and table netfilter replaces SRC_ip & SRC_port back by
> real?

After POSTROUTING, so you are not able to match them. But what you can
do is use CONNMARK target and connmark match to spot thoses connections.

Something like :

	iptables -A PREROUTING -t mangle -i LAN -p tcp --dport 80 \
		-j CONNMARK --set-mark 0x01

Now, every packet that belongs to a connection beginning by one of
theses packets will get connmarked with 0x01. To match them back, use
connmark match like this :

	-m connmark --mark 0x01

Hope it will help.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: iptables -j REDIRECT

[Martijn Lievaart]

Cedric Blancher wrote:

>Le lun 05/07/2004 à 23:08, Сергеев Сергей Николаевич a écrit :
>
>
>>how can I manage packets incoming from 80 port to my LAN?
>>All chains and tables(OUTPUT:mangle,nat,filter and
>>POSTROUTING:mangle,nat) shows that one go from
>>local_ip_of_gateway:3128.
>>But tcpdump started at LAN interface shows that packets go from real
>>ip addresses and src_port 80....
>>In what chain and table netfilter replaces SRC_ip & SRC_port back by
>>real?
>>
>>
>
>After POSTROUTING, so you are not able to match them. But what you can
>do is use CONNMARK target and connmark match to spot thoses connections.
>
>Something like :
>
>	iptables -A PREROUTING -t mangle -i LAN -p tcp --dport 80 \
>		-j CONNMARK --set-mark 0x01
>
>Now, every packet that belongs to a connection beginning by one of
>theses packets will get connmarked with 0x01. To match them back, use
>connmark match like this :
>
>	-m connmark --mark 0x01
>
>Hope it will help.
>
>
>

I don't think it will help. There is no nat going on after the
port-redirect. Squid will open a new tcp connection so the source-ip
will always be squids. Nothing you can do about that, but you can maybe
account for the traffic by using the squid logs.

HTH,
Martijn Lievaart

Re: iptables -j REDIRECT

[Cedric Blancher]

Le jeu 08/07/2004 à 18:08, Martijn Lievaart a écrit :
> I don't think it will help. There is no nat going on after the 
> port-redirect. Squid will open a new tcp connection so the source-ip 
> will always be squids. Nothing you can do about that, but you can maybe 
> account for the traffic by using the squid logs.

You're right if OP wants to filter communication between Squid and
destination webservers (most probable). I understood he wanted to spot
comminucations between Squid and his LAN.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!