All of lore.kernel.org
 help / color / mirror / Atom feed
From: =?unknown-8bit?q?Drago=C2=BA_Cintez=C3=A3?= <Dragos_Cinteza@web.de>
To: lartc@vger.kernel.org
Subject: [LARTC] Running in circles
Date: Sun, 12 Oct 2003 02:22:04 +0000	[thread overview]
Message-ID: <marc-lartc-106592542403221@msgid-missing> (raw)

   Hy  lartc members,


  I  only  ACCEPT 7 IP's in FORWARD chain, filtering by IP and MAC.
  Everything worked fine  until i needed to forward ports. The problem is
  that the nat PREROUTING chain is traversed before the filter FORWARD
  chain  and  this  way  the  packets  change their source and are not
  allowed to pass FORWARD that is restricted to only 7 IPs.


  I use this rules to forward the port:
iptables -t nat -A PREROUTING -p tcp --dport <port> -i <external NIC> -j DNAT --to <ip_intern>:<port> -d <ip_extern>
iptables -t nat -A PREROUTING -p udp --dport <port> -i <external NIC> -j DNAT --to <ip_intern>:<port> -d <ip_extern>

and this on the FORWARD chain that has a default policy to DROP
iptables -A FORWARD -i <internal NIC> -s 192.168.1.1 -m mac --mac-source xx-xx-xx-xx-xx-xx -j ACCEPT

Can I identify the marked packets to use them in iptables rules? This would help in this situation because the pakets traverse first the mangle table, get marked, then traverse the nat table where the source ip is changed and in the filter table if would be posible to use the marks i wowld identify the packets even if the source ip is changed.

Regards

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

                 reply	other threads:[~2003-10-12  2:22 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=marc-lartc-106592542403221@msgid-missing \
    --to=dragos_cinteza@web.de \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.