rewriting destination port of outbound packets

rewriting destination port of outbound packets

[Mason Schmitt]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I am attempting to configure a Linux box (mandrake 10.1 - iptables
1.2.9) to redirect http, ftp, real, winmedia, quicktime, and nntp to a
Netapp NetCache transparent caching proxy.

Here is my network layout:

~       Net
~        |
~  Linux router/fw
~        |
- ------switch-------
|             |
clients     cache

Starting first with http, I have made use of fwmark and iproute2 to
first mark traffic from our network to destination port 80 and then
route that traffic, out the same interface it came in on, to the web
cache.  The problem I am trying to resolve is that the traffic that I am
routing to the cache still has the  destination port 80.  I think this
needs to be 3128 (The cache accepts connections on port 3128).

So, is it possible to rewrite the destination port in this scenario?

- --
Mason Schmitt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCMJ3qbip6upg8pq8RAomJAKCVqlt6m45/Ib/mBX5SSTH/7aqVegCgj8Y1
4bV9hrjcqvqXxRv3jA2Vqt4=
=uNK8
-----END PGP SIGNATURE-----

Re: rewriting destination port of outbound packets

[Jason Opperisano]

On Thu, 2005-03-10 at 14:20, Mason Schmitt wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I am attempting to configure a Linux box (mandrake 10.1 - iptables
> 1.2.9) to redirect http, ftp, real, winmedia, quicktime, and nntp to a
> Netapp NetCache transparent caching proxy.
> 
> Here is my network layout:
> 
> ~       Net
> ~        |
> ~  Linux router/fw
> ~        |
> - ------switch-------
> |             |
> clients     cache
> 
> Starting first with http, I have made use of fwmark and iproute2 to
> first mark traffic from our network to destination port 80 and then
> route that traffic, out the same interface it came in on, to the web
> cache.  The problem I am trying to resolve is that the traffic that I am
> routing to the cache still has the  destination port 80.  I think this
> needs to be 3128 (The cache accepts connections on port 3128).
> 
> So, is it possible to rewrite the destination port in this scenario?

yeah--at some point in your packet mangling:

  iptables -t nat -A PREROUTING -i $INSIDE_IF -p tcp --dport 80 \
    -j DNAT --to-destination $NETCACHE_IP:3128

as an aside--your life would be infinitely easier if you added a third
NIC to the Linux router/fw and put the netcache on that segment...IMHO

-j

--
"Dear Baby, Welcome to Dumpsville. Population: You"
	--The Simpsons