port redirect for local host

port redirect for local host

[Michael Robinton]

I have a relatively simple redirect that does not seem to work for the
local host. I'm running a DNSBL on a virtual IP address on a host that
already has a DNS daemon running.

entry is...

$IPTABLES -t nat -A PREROUTING -p tcp -d $DNSBL_IP --dport 53 -j REDIRECT
--to-port $DNSBL_PORT

this works fine from both the network (internet) and from the interfaces
on the private side. eth1, eth0

I does not work at all from the local host and no amount of tweaking of
the rule set seems to help.

I've tried about every DNAT combination I can think of.

Any suggestions??

Michael

Re: port redirect for local host

[Ralf Spenneberg]

Am Die, 2003-09-02 um 07.00 schrieb Michael Robinton:
> I have a relatively simple redirect that does not seem to work for the
> local host. I'm running a DNSBL on a virtual IP address on a host that
> already has a DNS daemon running.
> 
> entry is...
> 
> $IPTABLES -t nat -A PREROUTING -p tcp -d $DNSBL_IP --dport 53 -j REDIRECT
> --to-port $DNSBL_PORT
> 
> this works fine from both the network (internet) and from the interfaces
> on the private side. eth1, eth0
> 
> I does not work at all from the local host and no amount of tweaking of
> the rule set seems to help.
locally generated packets do not traverse the PREROUTING but the OUTPUT
chain. 

Cheers,

Ralf
-- 
Ralf Spenneberg
RHCE, RHCX

Book: Intrusion Detection für Linux Server   http://www.spenneberg.com
IPsec-Howto				     http://www.ipsec-howto.org
Honeynet Project Mirror:                     http://honeynet.spenneberg.org