From: Jon Heese <netfilter@jonheese.com>
To: netfilter@lists.netfilter.org
Subject: Forward internal packets as though they're external
Date: Thu, 27 Oct 2005 00:04:57 -0400 [thread overview]
Message-ID: <436051E9.2050701@jonheese.com> (raw)
List,
I have a seemingly simple situation here that I have yet to find a
straightforward answer to, so here goes. I have my router/firewall
running iptables:
eth0 - 65.9.134.4
eth1 - 192.168.0.1
Then, say an internal machine, "castor":
eth0 - 192.168.0.100
I'm running a BitTorrent tracker on castor's TCP port 6969, and I'm
using iptables to forward traffic coming in router's eth0's port 6969 to
castor's 6969 (nat table, PREROUTING chain). No problem coming in from
outside.
The problem arises when I want to connect to castor's BitTorrent tracker
from another machine behind the router (on the 192.168.0.0/24 subnet).
It's matching the INPUT rule and sending the packet directly to router's
port 6969, instead of following the FORWARD rule to castor's 6969, and
while this makes sense to me, I don't want it to do it.
So, the simple solution, I say to myself, is to tell iptables to take
all packets with destination address of 65.9.134.4 and source address of
192.168.0.0/24 and dport 6969 to go to castor's 6969. In English I
think I have it fine. Finding the right syntax/logic in iptablesish is
where I get tripped up. I can match the rule fine, I just don't know
what action/jump I need to specify to make it redirect.
The rule is:
/sbin/iptables -A INPUT -d 65.9.134.4 -s 192.168.0.0/24 -p tcp --dport 6969
And if I add "-j DROP" or "-j ACCEPT", I get the appropriate action in
my testing situation. Now, the question:
What do I have to specify after the above rule definition to either a)
get iptables to redirect this packet to my existing nat/PREROUTING chain
(which may not be possible), or b) forward it directly to a specified
IP:port?
If you need any more specifics or code or if I posted this to the wrong
list, just let me know. Thanks in advance.
Regards,
Jon Heese
next reply other threads:[~2005-10-27 4:04 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-10-27 4:04 Jon Heese [this message]
2005-10-27 4:17 ` Forward internal packets as though they're external Buddy wu
2005-10-27 12:50 ` Jon Heese
2005-10-27 4:51 ` /dev/rob0
2005-10-27 13:07 ` Jon Heese
2005-10-27 14:38 ` /dev/rob0
2005-10-27 21:25 ` Jon Heese
2005-10-27 21:26 ` /dev/rob0
2005-10-27 23:32 ` Jon Heese
2005-10-27 23:38 ` Seferovic Edvin
[not found] <200510272238.j9RMcMFd006766@ajax.jonheese.com>
2005-10-27 23:49 ` Jon Heese
2005-10-27 23:55 ` Seferovic Edvin
[not found] <200510272255.j9RMtouv006919@ajax.jonheese.com>
2005-10-28 0:01 ` Jon Heese
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=436051E9.2050701@jonheese.com \
--to=netfilter@jonheese.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.