Re: iptables dnat, ebtables, mark

[Josh Nerius <jnerius@gmail.com>]

I have been experimenting with a very similar setup and have found
that in order to DNAT traffic transparently coming through the bridge,
it was necessary to set an ip address on the virtual bridge interface
and appropriate routes.

I haven't needed to use ebtables up to this point...Here is a rule
that I've used that I've had some luck with.

iptables -t nat -I PREROUTING -m physdev --physdev-in $IN_INT -m mac
--mac-source $MAC -j DNAT --to $WEBSERVER

Make sure to properly set the physdev interface. Though this isn't
entirely necessary, I've seen weird things happen without it.

It is important that the site you're DNATing to doesn't require host
headers as this has seemingly caused issues.

Another approach I'm experimenting with is DNATing dns requests
instead to a server set for the purpose of resolving everything to a
particular ip and then dropping all other traffic from that customer
that's not either destined for the dns server or the web server that
you're directing them to.

Let me know if this helps.

Josh Nerius

On Wed, 10 Nov 2004 16:42:46 +0100, Moritz Gartenmeister
<moritz@uplink-verein.ch> wrote:
> hi
> 
> my idea:
> i know the mac-adress from a compromised computer in my lan. i want to redirect all the traffic from
> this computer to a webserver (to show up a page with e.g. "bad guy! you got a virus").
> 
> my system:
> debian testing 2.6.7
> iptables
> ebtables
> bridge-code
> 
> my solution so far:
> ebtables -t nat -A PREROUTING -s $MAC -j mark --set-mark 8 --mark-target CONTINUE
> there are no other rules in this chain.
> some more rules in -A FORWARD all with -s macadress, but not the one above.
> 
> is the only rule in prerouting nat.
> iptables -t nat -A PREROUTING -m mark --mark 0x8 -j DNAT --to-destination $IP-WWW
> 
> is the first role in the mangle chain.
> iptables -t mangle -A PREROUTING -m mark --mark 0x8 -j ACCEPT
> 
> one check rule in mangl POSTROUTING
> iptables -t mangle -A POSTROUTING -m -mark --makr 0x8 -j LOG --log-prefix IPT_MARK
> 
> my problem:
> the user can access the webserver and only this server, but the user is not redirected to the
> web-server, if he tries to access e.g. www.google.com. he only get an error-message.
> 
> my observation:
> number of packets differ...
> ebtables 213 packets
> prerouting mangle 200 packets
> prerouting nat 118 packets
> postrouting mangle 93 packets
> 
> any explanations? the number should be at least the same. i don't understand this. the filter-rules
> seem to work properly...
> 
> cheers
> moritz
> 
> --
> Uplink student association
> Moritz Gartenmeister
> Bülachstrasse 1 F
> 8057 Zürich
> Switzerland
> 
> 


-- 
Math problems? Call 1-800-[(10x)(13i)^2]-[sin(xy)/2.362x]