Re: [PATCH] ipt_REDIRECT: only change dest-ip if not local ip

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Bas van Sisseren a écrit :
> 
> When redirecting, the destination address is replaced by the first
> ip-address on the receiving interface.

As described in the iptables manpage.

> If the packet originally was sent to the second ip-address (or third,
> fourth, etc..), this patch doesn't change the destination ip.

Is this patch in reaction to the recent thread "iptables not forwarding
port 443" in the netfilter user list from someone who stumbled into this
issue ?

My thoughts :
1) The iptables manpage would need to be updated accordingly.

2) I wonder whether it is really useful. The purpose of REDIRECT is to
make sure a packet is redirected to the local machine itself without the
need to care about the machine's address (just as MASQUERADE). If you
don't want to change the destination address or need finer control over
it, I believe DNAT can be used instead. Can you provide a use case ?

3) Why restrict only to the addresses attached to the receiving
interface ? Why not extend to any address attached to a host's
interface, or even any local address (such as the whole 127.0.0.0/8
prefix) ?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html