Re: DCERPC - does an add-on exist for netfilter

[Patrick McHardy <kaber@trash.net>]

On 30.01.2011 12:07, Jim Webster wrote:
> Hi.  I am new to the list and also fairly new to iptables and
> netfilter.  Linux and programming - am familiar with.
> Have been tasked to provide a way to move MSMQ (DCERPC?) traffic thru
> our firewall.
> The firewall is a CentOS iptables based box.
> 
> Unfortunately, I do not zet have the customer Wireshark trace showing
> the traffic, specificallz where the  address (and port) is supposedlz
> sent in the pazload.
> 
> A knowledgeable iptables/firewall person on our team has suggested we
> require a netfilter helper routine (ala the ftp connection tracking).
> 
> It seems to me however that instead, some tzpe of adaptive firewall
> technique is required to do this - opening a new NAT for the IP/port
> sent in the pazload and closing it when done.
> 
> If so, can this be done by a simple user app - perhaps a proxy, or
> should it be in the loadable kernel modules as the ftp connection
> tracker is?

Yes, you'll need a connection tracking helper that is able to
parse the DCERPC traffic in order to integrate this with netfilter
and NAT. I've looked into this a while ago, but due to the
complexity of the protocol it is non trivial.