port forwarding AND local application consumption...

port forwarding AND local application consumption...

[Lucas Diaz]

I use kernel 2.4.x.
I need to do port forwarding to a remote host AND to
pass these packets to a local application.

I used the DNAT feature in iptables and it does the
port forwarding. But the issue is that these forwarded
packets are unreachable to local application.

Any tips about proper iptables' rules to accomplish both?

Appreciate your help.
-D

Re: port forwarding AND local application consumption...

[Jan Engelhardt]

> I use kernel 2.4.x.
> I need to do port forwarding to a remote host AND to
> pass these packets to a local application.
>
> I used the DNAT feature in iptables and it does the
> port forwarding. But the issue is that these forwarded
> packets are unreachable to local application.

Of course, you just changed the IP address to something else than your 
own box. With DNAT, you explicitly 'give' up the connection for the 
local host.

>
> Any tips about proper iptables' rules to accomplish both?

Apart from writing your own target extensions, I know of none. Might use 
ipt_ROUTE as a base, it contains a --tee option.


Jan Engelhardt
-- 

Re: port forwarding AND local application consumption...

[dave]

I use redhat kernel 2.4.x and looks like I need to
rebuild the kernel if I want to use ROUTE target?

None of the iptables' rpms for fedora/redhat distro
contain libipt_ROUTE.so.

What is best way to incorporate ROUTE target in
my situation?

-D


--- Jan Engelhardt <jengelh@linux01.gwdg.de> wrote:

> > I use kernel 2.4.x.
> > I need to do port forwarding to a remote host AND
> to
> > pass these packets to a local application.
> >
> > I used the DNAT feature in iptables and it does
> the
> > port forwarding. But the issue is that these
> forwarded
> > packets are unreachable to local application.
> 
> Of course, you just changed the IP address to
> something else than your 
> own box. With DNAT, you explicitly 'give' up the
> connection for the 
> local host.
> 
> >
> > Any tips about proper iptables' rules to
> accomplish both?
> 
> Apart from writing your own target extensions, I
> know of none. Might use 
> ipt_ROUTE as a base, it contains a --tee option.
> 
> 
> Jan Engelhardt
> -- 
> 
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

Re: port forwarding AND local application consumption...

[dave]

Here is the related Bugzilla who direct the needed
ones to netfilter!
Bugzilla Bug 145642: iptables ROUTE target does not
work

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=145642#c3


-D


--- dave <ceek63@yahoo.com> wrote:

> 
> I use redhat kernel 2.4.x and looks like I need to
> rebuild the kernel if I want to use ROUTE target?
> 
> None of the iptables' rpms for fedora/redhat distro
> contain libipt_ROUTE.so.
> 
> What is best way to incorporate ROUTE target in
> my situation?
> 
> -D
> 
> 
> --- Jan Engelhardt <jengelh@linux01.gwdg.de> wrote:
> 
> > > I use kernel 2.4.x.
> > > I need to do port forwarding to a remote host
> AND
> > to
> > > pass these packets to a local application.
> > >
> > > I used the DNAT feature in iptables and it does
> > the
> > > port forwarding. But the issue is that these
> > forwarded
> > > packets are unreachable to local application.
> > 
> > Of course, you just changed the IP address to
> > something else than your 
> > own box. With DNAT, you explicitly 'give' up the
> > connection for the 
> > local host.
> > 
> > >
> > > Any tips about proper iptables' rules to
> > accomplish both?
> > 
> > Apart from writing your own target extensions, I
> > know of none. Might use 
> > ipt_ROUTE as a base, it contains a --tee option.
> > 
> > 
> > Jan Engelhardt
> > -- 
> > 
> > 
> 
> 
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam
> protection around 
> http://mail.yahoo.com 
> 
> 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com