From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?iso-8859-1?Q?Hern=E1n_Mailluquet?= Subject: Redirection question. Date: Tue, 11 Mar 2003 12:04:16 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001e01c2e7df$7bfd3430$0db600c8@ANTARES1> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_001B_01C2E7C6.56A3C730" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_001B_01C2E7C6.56A3C730 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, i have doing transparent proxy with squid and this port redirect = rule: iptables -t nat -A PREROUTING -i eth1 -p TCP --dport 80 -j REDIRECT = --to-port 8080 and works fine. Now, i want dont't redirect some request to destination = dirs like 192.168.0.0/24 and 192.168.1.0/24 (for example). How i can do = this?=20 Thanks. ------=_NextPart_000_001B_01C2E7C6.56A3C730 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi, i have doing transparent proxy with = squid and this port redirect rule:

iptables -t nat -A PREROUTING -i eth1 = -p TCP=20 --dport 80 -j REDIRECT --to-port 8080

and works fine. Now, i want dont't = redirect some=20 request to destination dirs like 192.168.0.0/24 and 192.168.1.0/24 (for=20 example). How i can do this? =

Thanks.

------=_NextPart_000_001B_01C2E7C6.56A3C730-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jesper Lund" Subject: Re: Redirection question. Date: Tue, 11 Mar 2003 16:20:30 +0100 (CET) Sender: netfilter-admin@lists.netfilter.org Message-ID: <3155.212.242.51.102.1047396030.squirrel@www.ballbreaker.dk> References: <001e01c2e7df$7bfd3430$0db600c8@ANTARES1> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <001e01c2e7df$7bfd3430$0db600c8@ANTARES1> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: hernan@mdp.edu.ar Cc: netfilter@lists.netfilter.org > Hi, i have doing transparent proxy with squid and this port redirect > rule: > > iptables -t nat -A PREROUTING -i eth1 -p TCP --dport 80 -j REDIRECT > --to-port 8080 > > and works fine. Now, i want dont't redirect some request to destination > dirs like 192.168.0.0/24 and 192.168.1.0/24 (for example). How i can do > this? You could make som ACCEPT'ing rules before you REDIRECT: iptables -t nat -A PREROUTING -i eth1 -p TCP --dport 80 -d 192.168.0.0/24 -j ACCEPT iptables -t nat -A PREROUTING -i eth1 -p TCP --dport 80 -d 192.168.1.0/24 -j ACCEPT Regards, Jesper From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasa Stupar Subject: Redirection question Date: Mon, 20 Dec 2004 18:02:25 +0100 Message-ID: <41C705A1.2040107@stupar.homelinux.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org Hi! I have installed mail server on my lan. Now I would like to redirect all lan users to use that mail server as smtp (similar as transparent proxy with squid). How do I do that smtp redirection? I was thinking something like: ------------- iptables -t nat -A PREROUTING -i eth0 -s ! smtp-box -p tcp --dport 25 -j DNAT --to smtp-box:25 iptables -t nat -A POSTROUTING -o eth0 -s local-network -d smtp-box -j SNAT --to iptables-box iptables -A FORWARD -s local-network -d smtp-box -i eth0 -o eth0 -p tcp --dport 25 -j ACCEPT -------------- Is this correct? Regards, Sasa From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasa Stupar Subject: Re: Redirection question Date: Mon, 20 Dec 2004 18:05:49 +0100 Message-ID: <41C7066D.7050604@stupar.homelinux.net> References: <41C705A1.2040107@stupar.homelinux.net> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <41C705A1.2040107@stupar.homelinux.net> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1"; format="flowed" To: netfilter@lists.netfilter.org Sasa Stupar a =C3=A9crit : > Hi! >=20 > I have installed mail server on my lan. Now I would like to redirect al= l=20 > lan users to use that mail server as smtp (similar as transparent proxy= =20 > with squid). How do I do that smtp redirection? > I was thinking something like: > ------------- > iptables -t nat -A PREROUTING -i eth0 -s ! smtp-box -p tcp --dport 25 -= j=20 > DNAT --to smtp-box:25 > iptables -t nat -A POSTROUTING -o eth0 -s local-network -d smtp-box -j = > SNAT --to iptables-box > iptables -A FORWARD -s local-network -d smtp-box -i eth0 -o eth0 -p tcp= =20 > --dport 25 -j ACCEPT > -------------- > Is this correct? >=20 > Regards, > Sasa >=20 I forgot some more infos: running on FC3 with sendmail. This is also a router with 2 NIC installed: one for internet and one for LAN. Sasa From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasa Stupar Subject: Re: Redirection question Date: Mon, 20 Dec 2004 22:33:06 +0100 Message-ID: <41C74512.6080604@stupar.homelinux.net> References: <41C705A1.2040107@stupar.homelinux.net> <41C7066D.7050604@stupar.homelinux.net> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <41C7066D.7050604@stupar.homelinux.net> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="utf-8"; format="flowed" To: Netfilter ML Sasa Stupar a =C3=A9crit : > Sasa Stupar a =C3=A9crit : >=20 >> Hi! >> >> I have installed mail server on my lan. Now I would like to redirect=20 >> all lan users to use that mail server as smtp (similar as transparent = >> proxy with squid). How do I do that smtp redirection? >> I was thinking something like: >> ------------- >> iptables -t nat -A PREROUTING -i eth0 -s ! smtp-box -p tcp --dport 25 = >> -j DNAT --to smtp-box:25 >> iptables -t nat -A POSTROUTING -o eth0 -s local-network -d smtp-box -j= =20 >> SNAT --to iptables-box >> iptables -A FORWARD -s local-network -d smtp-box -i eth0 -o eth0 -p=20 >> tcp --dport 25 -j ACCEPT >> -------------- >> Is this correct? >> >> Regards, >> Sasa >> >=20 > I forgot some more infos: > running on FC3 with sendmail. This is also a router with 2 NIC > installed: one for internet and one for LAN. >=20 > Sasa Solved. It is working as I have mentioned above. Sasa From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Hudson Delbert J Contr 61 CS/SCBN" Subject: RE: Redirection question Date: Mon, 20 Dec 2004 14:47:23 -0800 Message-ID: <186AC876521E0F46BDE77079A6567FD05B0058@la-ncc-ms1nsabb.losangeles.afspc.ds.af.mil> Mime-Version: 1.0 Content-Transfer-Encoding: base64 Return-path: Content-class: urn:content-classes:message List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="utf-8" To: Sasa Stupar , Netfilter ML aSBndWVzcyBpIG5lZWQgdG8gYXNrIHdoYXQgcm9sZSB5b3UgcGxheSBpbiB0aGUgbGFuIGFkbWlu Pw0KDQppIHRoaW5rIGl0IG1pZ2h0IGJlIGVhc2llciB0byBtb2RpZnkgbXggdHlwZSBwb2ludGVy IG1lY2hhbmlzbXMgb24gdGhlIGNsaWVudHMNCmluc3RlYWQgb2YgaGF2aW5nIHRoZSBmdyBkbyBh bGwgdGhpcyB3YXN0ZWZ1bCByZWRpcnMuIHRoZXkgYXJlIHdhc3RlZnVsDQpiZWNhdXNlIHlvdSBu b3cgd2hlcmUgeW91IHdhbnQgdGhlIG1haWwgdHJhZmZpYyB0byBnbyAtIHRoaXMgaXNudCBjbGV2 ZXIuDQppdHMgYSB3YXkgdG8gcGVyZm9ybSB0aGlzIHRhc2sgYnV0IGl0cyBub3QgdmVyeSBlbGVn YW50IGFuZCBkb2VzbnQgc2NhbGUgZm9yDQptYW5pbnRlbmFuY2UuDQoNCm91dC4uLg0KDQoNCi0t LS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBuZXRmaWx0ZXItYm91bmNlc0BsaXN0cy5u ZXRmaWx0ZXIub3JnDQpbbWFpbHRvOm5ldGZpbHRlci1ib3VuY2VzQGxpc3RzLm5ldGZpbHRlci5v cmddT24gQmVoYWxmIE9mIFNhc2EgU3R1cGFyDQpTZW50OiBNb25kYXksIERlY2VtYmVyIDIwLCAy MDA0IDE6MzMgUE0NClRvOiBOZXRmaWx0ZXIgTUwNClN1YmplY3Q6IFJlOiBSZWRpcmVjdGlvbiBx dWVzdGlvbg0KDQoNClNhc2EgU3R1cGFyIGEgw6ljcml0IDoNCg0KPiBTYXNhIFN0dXBhciBhIMOp Y3JpdCA6DQo+IA0KPj4gSGkhDQo+Pg0KPj4gSSBoYXZlIGluc3RhbGxlZCBtYWlsIHNlcnZlciBv biBteSBsYW4uIE5vdyBJIHdvdWxkIGxpa2UgdG8gcmVkaXJlY3QgDQo+PiBhbGwgbGFuIHVzZXJz IHRvIHVzZSB0aGF0IG1haWwgc2VydmVyIGFzIHNtdHAgKHNpbWlsYXIgYXMgdHJhbnNwYXJlbnQg DQo+PiBwcm94eSB3aXRoIHNxdWlkKS4gSG93IGRvIEkgZG8gdGhhdCBzbXRwIHJlZGlyZWN0aW9u Pw0KPj4gSSB3YXMgdGhpbmtpbmcgc29tZXRoaW5nIGxpa2U6DQo+PiAtLS0tLS0tLS0tLS0tDQo+ PiBpcHRhYmxlcyAtdCBuYXQgLUEgUFJFUk9VVElORyAtaSBldGgwIC1zICEgc210cC1ib3ggLXAg dGNwIC0tZHBvcnQgMjUgDQo+PiAtaiBETkFUIC0tdG8gc210cC1ib3g6MjUNCj4+IGlwdGFibGVz IC10IG5hdCAtQSBQT1NUUk9VVElORyAtbyBldGgwIC1zIGxvY2FsLW5ldHdvcmsgLWQgc210cC1i b3ggLWogDQo+PiBTTkFUIC0tdG8gaXB0YWJsZXMtYm94DQo+PiBpcHRhYmxlcyAtQSBGT1JXQVJE IC1zIGxvY2FsLW5ldHdvcmsgLWQgc210cC1ib3ggLWkgZXRoMCAtbyBldGgwIC1wIA0KPj4gdGNw IC0tZHBvcnQgMjUgLWogQUNDRVBUDQo+PiAtLS0tLS0tLS0tLS0tLQ0KPj4gSXMgdGhpcyBjb3Jy ZWN0Pw0KPj4NCj4+IFJlZ2FyZHMsDQo+PiBTYXNhDQo+Pg0KPiANCj4gSSBmb3Jnb3Qgc29tZSBt b3JlIGluZm9zOg0KPiBydW5uaW5nIG9uIEZDMyB3aXRoIHNlbmRtYWlsLiBUaGlzIGlzIGFsc28g YSByb3V0ZXIgd2l0aCAyIE5JQw0KPiBpbnN0YWxsZWQ6IG9uZSBmb3IgaW50ZXJuZXQgYW5kIG9u ZSBmb3IgTEFOLg0KPiANCj4gU2FzYQ0KDQpTb2x2ZWQuIEl0IGlzIHdvcmtpbmcgYXMgSSBoYXZl IG1lbnRpb25lZCBhYm92ZS4NCg0KU2FzYQ0KDQoNCg== From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasa Stupar Subject: RE: Redirection question Date: Tue, 21 Dec 2004 08:52:16 +0100 Message-ID: <1103615536.3607.6.camel@localhost.localdomain> References: <186AC876521E0F46BDE77079A6567FD05B0058@la-ncc-ms1nsabb.losangeles.afspc.ds.af.mil> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-bx7EEJNCW6Zaoc1WfTGK" Return-path: In-Reply-To: <186AC876521E0F46BDE77079A6567FD05B0058@la-ncc-ms1nsabb.losangeles.afspc.ds.af.mil> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org To: Netfilter-List --=-bx7EEJNCW6Zaoc1WfTGK Content-Type: text/plain; charset=iso-8859-2 Content-Transfer-Encoding: quoted-printable I did that because of one reason - viruses/worms sending from infected computer by using mail server settings in the clients Outlook. But clients also have some other accounts and not only local so I get complains from my ISP and other that I am sending spam vith viruses. This way I redirect all smtp traffic to my server which requires client authentication. And if some worms/viruses have their own smtp server they are also redirected to my internal mail server which will block anauthorized relay attempt. Sasa V pon, 20.12.2004 ob 23:47 je Hudson Delbert J Contr 61 CS/SCBN napisal(a): > i guess i need to ask what role you play in the lan admin? >=20 > i think it might be easier to modify mx type pointer mechanisms on the cl= ients > instead of having the fw do all this wasteful redirs. they are wasteful > because you now where you want the mail traffic to go - this isnt clever. > its a way to perform this task but its not very elegant and doesnt scale = for > manintenance. >=20 > out... >=20 >=20 > -----Original Message----- > From: netfilter-bounces@lists.netfilter.org > [mailto:netfilter-bounces@lists.netfilter.org]On Behalf Of Sasa Stupar > Sent: Monday, December 20, 2004 1:33 PM > To: Netfilter ML > Subject: Re: Redirection question >=20 >=20 > Sasa Stupar a =E9crit : >=20 > > Sasa Stupar a =E9crit : > >=20 > >> Hi! > >> > >> I have installed mail server on my lan. Now I would like to redirect=20 > >> all lan users to use that mail server as smtp (similar as transparent=20 > >> proxy with squid). How do I do that smtp redirection? > >> I was thinking something like: > >> ------------- > >> iptables -t nat -A PREROUTING -i eth0 -s ! smtp-box -p tcp --dport 25=20 > >> -j DNAT --to smtp-box:25 > >> iptables -t nat -A POSTROUTING -o eth0 -s local-network -d smtp-box -j= =20 > >> SNAT --to iptables-box > >> iptables -A FORWARD -s local-network -d smtp-box -i eth0 -o eth0 -p=20 > >> tcp --dport 25 -j ACCEPT > >> -------------- > >> Is this correct? > >> > >> Regards, > >> Sasa > >> > >=20 > > I forgot some more infos: > > running on FC3 with sendmail. This is also a router with 2 NIC > > installed: one for internet and one for LAN. > >=20 > > Sasa >=20 > Solved. It is working as I have mentioned above. >=20 > Sasa >=20 >=20 --=-bx7EEJNCW6Zaoc1WfTGK Content-Type: application/pgp-signature; name=signature.asc Content-Description: To je digitalno podpisani del =?iso-8859-2?Q?sporo=E8ila?= -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQBBx9YvZfogXwY+ISIRAuCLAKC6lrLkioXpLkI9S/MirrgZZg4lVQCgl1H/ widf0uDiS+QX/4f3kgnwW/Q= =g+7l -----END PGP SIGNATURE----- --=-bx7EEJNCW6Zaoc1WfTGK--