Re: matching -d to a given interface without specifying ip address

[Dmitri <dk-netfilter@nth.ca>]

Rob Sterenborg wrote:
>> Is there a way to define a condition "those packets whose destination
>> is the IP address of the given interface" without specifying the
>> actual IP address? (it changes, thus needs to be detected and updated)
> 
> No. -d expects an IP address.
I was looking for a (non-existent) option like 
--dest-ip-address-matches-that-of eth1. Meaning the connection is 
addressed to the box, as opposed to passing through it to some other 
machine but to the same port.

The problem with specifying an IP is that it may change, which breaks 
the rules and requires an update (and detection as well). Event for a 
static IP, that's an extra dependency to watch out for.

> What is it exactly what you want to accomplish?

Maybe this is contrived and not a good method..

I want the above-described kind of option, to pick out and DNAT 
connections on a certain port (say, http) directed at the box, but not 
those on the same port but directed elsewhere (like google being 
accessed through the box being the gateway). Purpose - to 
DNAT-encapsulate some service by the box.

(It doesn't matter from which direction it came, on which interface, its 
contents, etc. - only the destination ip.)

If i say "-d <ip.of.the.box> --dport 80 -j DNAT ..", that works, but it 
introduces the unwanted dependency on the actual IP value.

If i say "-i <interface> --dport 80..." for an internal interface, that 
catches anything, whether it was meant for the box or google.

Thanks,
--Dmitri