Re: [PATCH] ipt_REDIRECT: only change dest-ip if not local ip

[Patrick McHardy <kaber@trash.net>]

Am 16.07.2010 14:42, schrieb Bas van Sisseren:
> Hello Patrick,
> 
> In most situations, all addresses are known in advance (although we have
> some situations where we both have a static address and a dhcp'ed address on
> the same interface).

At least in the cases where the addresses are known in advance, you can
handle this through the ruleset.

> The problem is that we can't tell the other end to use the first address on
> the interface. Some systems use the first address, others use the second
> address. When a connection is set up from the remote system to the second
> address, the original REDIRECT redirects the connection to the configured
> port-number on the first address.
> 
> It seems way more logical to me to keep the destination address the same and
> only change the port number if the destination address is locally configured
> on that interface.
> 
> 
> Assume:
>   eth0 has these addresses:
>     10.1.0.1, netmask 255.255.255.0  (primary address)
>     10.2.0.1, netmask 255.255.255.0
>     10.3.0.1, netmask 255.255.255.0
>     10.4.0.1, netmask 255.255.255.0
> 
>   and redirects from.. say.. port 80 to 8080
> 
>   Connections to 10.1.0.1:80 will be redirected to 10.1.0.1:8080
>   But also all connections to 10.2.0.1:80, 10.3.0.1:80 and
>   10.4.0.1:80 will be redirected to 10.1.0.1:8080
> 
> 
> With the patch, the connection to 10.2.0.1:80 will be redirected to
> 10.2.0.1:8080, 10.3.0.1:80 to 10.3.0.1:8080, etc..

OK, so basically you just want to rewrite the port number. An easier
way to do this without iterating through all addresses would be to
change userspace and the kernel so you can create REDIRECT rules
without the IP_NAT_RANGE_MAP_IPS flag. That won't work for forwarded
packets, but its the simplest solution for the case you describe.