Re: clone packet with new destination address

[Stephen Clark <sclark46@earthlink.net>]

On 11/01/2010 11:00 AM, Changli Gao wrote:
> On Mon, Nov 1, 2010 at 10:29 PM, Stephen Clark<sclark46@earthlink.net>  wrote:
>    
>> I am not sure on how to go about doing that, looking at the code for TEE it
>> looks
>> like the cloned packet bypasses any of the remaining iptables chains.
>>      
> It isn't true. The cloned packet only bypasses the iptables rule where
> it is generated.
>
>    
>> So
>> where
>> would I change the destination address? Also if I am mistaken and it does
>> hit
>> one of the remaining iptables chains how do I tell it is not the original
>> but the
>> cloned packet I want to change to the new destination address?
>>
>>      
> I think you can use the RAWSNAT xtables-addon to change the
> destination address. Since the new skb is attached to untracked ct,
> you can use match conntrack --ctstate UNTRACKED to filter it out.
>
>    
Hi Changli,

Thank you very much for the reply, But wouldn't it be RAWDNAT since  I 
want to
change the destination address?

Steve

-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)