redirect a HTTP-connection only once

redirect a HTTP-connection only once

[Karl Gruber]

Hi!

I want to know if it is possible that an iptables-rule matches only once. I 
want to implement a redirection of the first http-request of an user.

thanx,
     Karl

Re: redirect a HTTP-connection only once

[Joel Newkirk]

On Friday 15 November 2002 03:28 pm, Karl Gruber wrote:
> Hi!
>
> I want to know if it is possible that an iptables-rule matches only once. I
> want to implement a redirection of the first http-request of an user.
>
> thanx,
>      Karl

disclaimer - I've never done this before...

Do you mean the first ever (IE only catch one, then never again) or the first 
to a given destination, or what? 

Matching TCP80 from a user with state NEW and TCP flag SYN without ACK or RST 
should catch the initial HTTP request in a given transaction, and repeat 
every time a new request is initiated.  I believe a LIMIT match (1/day) with 
no burst watching for these would catch only the first HTTP transaction 
requested by a user each day. (or until the firewall is reset, whichever is 
sooner)  

But the packet itself will probably be effectively lost if you redirect only 
the first, leaving the client to re-request.  If you divert a single packet 
then reinsert it somehow, I think netfilter will not properly handle 
forwarding of subsequent packets that are part of the transaction.

Something like:

/sbin/iptables -A FORWARD -s w.x.y.z -p tcp --dport 80 --state NEW --tcp-flags 
SYN,RST,ACK SYN -m limit --limit 1/day --limit-burst 1 -j {whatever target}

Should match ONLY the first request from w.x.y.z for an HTTP connection per 
day.  Would that suit your use?

j

arptables

[Toshihiro Sonoda]

hi,

I can find the arp_filter.c and arp_tables.c in "net/ipv4/netfilter/" of kernel tree (2.4.18).
But, I can not find the document about how to use the arp filtering.

How can I use the arp filtering in linux.
Please teach me.

regard, toshihiro.

Test (I am not recieving mails since 15.11.2002)

[Erdal Mutlu]

Hello,

is this list dead?

Erdal Mutlu

Test: is this list alive

[Erdal Mutlu]

Hello,

I don't get any messages from this list. What is going on?

Erdal Mutlu
System Administrator

Du-Pont-Strasse 1
D-61352 Bad Homburg
Tel.: +49 6172 484 - 447
Fax: +49 6172 484 - 5447
email: emutlu@fonts.de
http://www.linotypelibrary.com
http://www.fonts.de

On Fri, 15 Nov 2002, Karl Gruber wrote:

> Hi!
>
> I want to know if it is possible that an iptables-rule matches only once. I
> want to implement a redirection of the first http-request of an user.
>
> thanx,
>      Karl
>
>
>
>
>
>

Re: arptables

[Cedric Blancher]

Le mar 19/11/2002 à 07:47, Toshihiro Sonoda a écrit :
> I can find the arp_filter.c and arp_tables.c in "net/ipv4/netfilter/" of kernel tree (2.4.18).
> But, I can not find the document about how to use the arp filtering.
> How can I use the arp filtering in linux.

Akaik, there's still no userland tool to configure ARP filtering into
kernel (aka arptables tool) and associated library.

So the first step would be implementing kernel/userland interface...

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

Re: arptables

[Ben Russo]

On Fri, 2002-11-22 at 05:18, Cedric Blancher wrote:
> Le mar 19/11/2002 à 07:47, Toshihiro Sonoda a écrit :
> > I can find the arp_filter.c and arp_tables.c in "net/ipv4/netfilter/" of kernel tree (2.4.18).
> > But, I can not find the document about how to use the arp filtering.
> > How can I use the arp filtering in linux.
> 
> Akaik, there's still no userland tool to configure ARP filtering into
> kernel (aka arptables tool) and associated library.
> 
> So the first step would be implementing kernel/userland interface...

Just a half baked idea....

I havent tested this, but the /etc/ethers (man 5 ethers)
is used for storing arp cache information statically, like /etc/hosts
in /etc/rc.local you could call:

/sbin/arp -f /etc/ethers

The /etc/ethers file might contain:
	00:08:02:88:88:88 10.10.10.10

If you had no 10.10.10.10 anywhere on your network!
Then you could set rules in your iptables that DROP all 10.10.10.10 
packets from source and destination, in all tables.

From the "arp" man page "If the temp flag is
              not supplied entries will be permanent stored  into
              the ARP cache."

-Ben.

routing with the iptables

[Rimas]

Hi guys,

I have a Linux box (Redhat 7.3) with two network cards.
eth0 is connection to my wireless ISP and eth1 is to my Firewalls (I have
them two one is main Fw and the second one backup, just in case if a first
one gets faulty ).
I want to route eth0<-->eht1. Both NICs have real Internet IPs and FWs as
well.
FWS NICs and router eth1 are on the same subnet and router is default
gateway for my FWs.
I need no NAT (no needs to hide my real IP, because it have to be seen from
Internet and will be accessible with all ports).


What iptables commands I have to use of it.

Thank you

Remus