Re: How does iptables redirect a packet that is not addressed to its local machi

Re: How does iptables redirect a packet that is not addressed to its local machi

[Grace Li]

Yes, Client and Server are in the same network!

I used the Ethereal tool, which is similiar to but better than tcpdump.  On 
Client, Server and Gateway, I could all always see that packets are sending 
back and forth from Server and Client.  There is no sign that Gateway 
receives packets on port 1888 or 2000.

Thanks,

Grace


>From: wanghtb@legend.com.cn
>To: netfilter-devel@lists.netfilter.org
>CC: zheyinli@hotmail.com
>Subject: Re: How does iptables redirect a packet that is not addressed to 
>its local machine
>Date: Thu, 8 Apr 2004 09:47:15 +0800
>
>Hi, I wonder if the Client and the Server are in the same network,
>under which the Gateway will send a ICMP Redirect message to
>make the Client access Server directly. version is iptables
>
>Please check netmask of the Machines and use tcpdump packet in the
>Gateway to see what happens:-)
>
> >Hi,
> >
> >I am just wondering if anybody could explain what happened in the =
> >following experiments:
>
> >Client (192.168.1.134) tries to connect to port 1888 of Server
> >(192.168.1.115) through Gateway (192.168.1.1).  In the Gateway, the =
> >iptables
> >has been instructed to redirect traffic on port 1888 to 2000 (iptables =
> >-t
> >nat -A PREROUTING -i eth0 -p tcp --dport 1888 -j REDIRECT -to-port 2000 =
> >).
> >
> >The results of my experiments is that the application on Gateway who =
> >listens
> >to port 2000 could not get anything, while Server receives everything
> >expected on its port 1888. So my question is that did iptables do =
> >anything
> >here?
> >
> >Many thanks,
> >
> >Grace
>

_________________________________________________________________
STOP MORE SPAM with the MSN Premium and get 2 months FREE*    
http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=http://hotmail.com/enca&HL=Market_MSNIS_Taglines

Re: How does iptables redirect a packet that is not addressed to its local machi

[Grace Li]

>From: Phil Oester <kernel@linuxace.com>
>To: Grace Li <zheyinli@hotmail.com>
>CC: netfilter-devel@lists.netfilter.org
>Subject: Re: How does iptables redirect a packet that is not addressed to 
>its local machine
>Date: Wed, 7 Apr 2004 16:40:58 -0700
>
>Perhaps you haven't added a corresponding rule to the INPUT table
>to actually allow port 2000 to the gateway?
>
>Phil
>
>On Wed, Apr 07, 2004 at 06:16:07PM -0700, Grace Li wrote:
> > Hi,
> >
> > I am just wondering if anybody could explain what happened in the 
>following experiments:
> >
> > Client (192.168.1.134) tries to connect to port 1888 of Server
> > (192.168.1.115) through Gateway (192.168.1.1).  In the Gateway, the 
>iptables
> > has been instructed to redirect traffic on port 1888 to 2000 (iptables 
>-t
> > nat -A PREROUTING -i eth0 -p tcp --dport 1888 -j REDIRECT -to-port 2000 
>).
> >
> > The results of my experiments is that the application on Gateway who 
>listens
> > to port 2000 could not get anything, while Server receives everything
> > expected on its port 1888. So my question is that did iptables do 
>anything
> > here?
> >
> > Many thanks,
> >
> > Grace
> >

_________________________________________________________________
http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=http://hotmail.com/enca&HL=Market_MSNIS_Taglines

Re: How does iptables redirect a packet that is not addressed to its local machi

[Chris Wilson]

Hi Grace,

> Yes, Client and Server are in the same network!
> 
> I used the Ethereal tool, which is similiar to but better than tcpdump.  On 
> Client, Server and Gateway, I could all always see that packets are sending 
> back and forth from Server and Client.  There is no sign that Gateway 
> receives packets on port 1888 or 2000.

If you ping the Server from the Client, does it go through the Gateway? 
Probably not, because Client and Server are in the same subnet and on the 
same physical LAN. In this case, the packets never arrive at Gateway, so 
iptables on Gateway can't do anything to intercept or modify them.

You could try setting a route on the Client which points to the Server, 
but using Gateway as the gateway of the route.

Cheers, Chris.
-- 
_  __ __     _
 / __/ / ,__(_)_  | Chris Wilson -- UNIX Firewall Lead Developer |
/ (_  ,\/ _/ /_ \ | NetServers.co.uk http://www.netservers.co.uk |
\__/_/_/_//_/___/ | 21 Signet Court, Cambridge, UK. 01223 576516 |

Re: How does iptables redirect a packet that is not addressed to its local machi

[Grace Li]

[root@localhost grace]# iptables-save -t nat
# Generated by iptables-save v1.2.7a on Thu Apr  8 11:07:44 2004
*nat
:PREROUTING ACCEPT [1:229]
:POSTROUTING ACCEPT [4:240]
:OUTPUT ACCEPT [4:240]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1888 -j REDIRECT --to-ports 2000
COMMIT


>From: Henrik Nordstrom <hno@marasystems.com>
>To: Grace Li <zheyinli@hotmail.com>
>CC: netfilter-devel@lists.netfilter.org
>Subject: Re: How does iptables redirect a packet that is not addressed to 
>its local machine
>Date: Thu, 8 Apr 2004 00:48:33 +0200 (CEST)
>
>On Wed, 7 Apr 2004, Grace Li wrote:
>
> > Hi,
> >
> > I am just wondering if anybody could explain what happened in the 
>following experiments:
> >
> > Client (192.168.1.134) tries to connect to port 1888 of Server
> > (192.168.1.115) through Gateway (192.168.1.1).  In the Gateway, the 
>iptables
> > has been instructed to redirect traffic on port 1888 to 2000 (iptables 
>-t
> > nat -A PREROUTING -i eth0 -p tcp --dport 1888 -j REDIRECT -to-port 2000 
>).
>
>Works here...
>
>
> > The results of my experiments is that the application on Gateway who 
>listens
> > to port 2000 could not get anything, while Server receives everything
> > expected on its port 1888. So my question is that did iptables do 
>anything
> > here?
>
>No idea. This is a kind of thing which has always worked for me, but you
>are the second person in a few days reporting this is not working..
>
>Exacly what kernel and iptables version are you using on the gateway?
>
>What does "iptables-save -t nat" give?
>
>Regards
>Henrik
>

_________________________________________________________________
Add photos to your e-mail with MSN Premium. Get 2 months FREE*  
http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=http://hotmail.com/enca&HL=Market_MSNIS_Taglines

Re: How does iptables redirect a packet that is not addressed to its local machi

[Henrik Nordstrom]

On Thu, 8 Apr 2004, Grace Li wrote:

> [root@localhost grace]# iptables-save -t nat
> # Generated by iptables-save v1.2.7a on Thu Apr  8 11:07:44 2004
> *nat
> :PREROUTING ACCEPT [1:229]
> :POSTROUTING ACCEPT [4:240]
> :OUTPUT ACCEPT [4:240]
> -A PREROUTING -i eth0 -p tcp -m tcp --dport 1888 -j REDIRECT --to-ports 2000
> COMMIT

Ok, and which kernel version?

Regards
Henrik

Re: How does iptables redirect a packet that is not addressed to its local machi

[Henrik Nordstrom]

On Thu, 8 Apr 2004, Grace Li wrote:

> Yes, Client and Server are in the same network!

For IPTABLES to work on the gateway both the client and server MUST send
the traffic via the gateway. You can not have iptables on the gateway
magically work on traffic which goes directly between the client<->server
not involving the gateway..

Regards
Henrik