From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Bassam A. Al-Khaffaf" Subject: How to DNAT the only NetBios broadcast traffic (03:00:00:00:00:01)?? Date: Mon, 14 Jun 2004 12:08:23 +0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001b01c451c5$3c734150$1d01a8c0@palettemm.com> Reply-To: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_001C_01C45208.4A968150" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_001C_01C45208.4A968150 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Dear All, I am implementing a Linux box gateway that lunch my own firewall (I wrote my own iptables rules). The gateway connects two LANs, LAN1: 192.168.1.0/24 and LAN2: 192.168.0.0/24. LAN1 contains a windows 2000 server domain controller IP: 192.168.1.231 and LAN2 contains my clients based on windows xp. =20 In fact I got stuck on how to forward ONLY and ONLY the NETBIOS broadcast traffic (03:00:00:00:00:01) from any machine on LAN2 to the domain controller on LAN1. Take note that the NETBIOS traffic is carried on IEEE 802.3 Ethernet. =20 I wrote the following iptable rule, but here all the traffic will be directed from LAN2 to the domain controller on LAN1 Iptables =96t nat =96A PREROUTING =96I eth1 =96j DNAT =96to-destination 192.168.1.231 =20 So can anybody help me on how can I forward the traffic with destination MAC address 03:00:00:00:00:01 from LAN2 to the domain controller (192.168.1.231) on LAN1? =20 Thanks for your support =20 Regards Bassam =20 =20 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.516 / Virus Database: 313 - Release Date: 9/1/2003 =20 ------=_NextPart_000_001C_01C45208.4A968150 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Dear All,

= I am implementing a Linux box gateway that lunch my own firewall (I wrote my = own iptables rules). The gateway connects two LANs, = LAN1: 192.168.1.0/24 and LAN2: 192.168.0.0/24. LAN1 contains a windows 2000 = server domain controller IP: 192.168.1.231 and LAN2 contains my clients based on = windows xp.

In fact I got stuck on how to forward ONLY and ONLY = the NETBIOS broadcast traffic (03:00:00:00:00:01) from any machine on LAN2 to the domain controller on LAN1. Take note that the = NETBIOS traffic is carried on IEEE 802.3 Ethernet.

I wrote the following iptable rule, but here all the traffic will be directed from LAN2 to the domain controller on LAN1

Iptables =96t nat =96A PREROUTING =96I eth1 =96j = DNAT =96to-destination 192.168.1.231

So can anybody help me on how can I forward the = traffic with destination MAC address 03:00:00:00:00:01 from LAN2 to the domain controller (192.168.1.231) on = LAN1?

Thanks for your support

Regards

Bassam<= font size=3D2 face=3DArial>

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.516 / Virus Database: 313 - Release Date: 9/1/2003

------=_NextPart_000_001C_01C45208.4A968150-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "John A. Sullivan III" Subject: Re: How to DNAT the only NetBios broadcast traffic (03:00:00:00:00:01)?? Date: Mon, 14 Jun 2004 10:45:43 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1087224343.5243.39.camel@localhost> References: <001b01c451c5$3c734150$1d01a8c0@palettemm.com> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <001b01c451c5$3c734150$1d01a8c0@palettemm.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="utf-8" To: bassam@palettemm.com Cc: netfilter@lists.netfilter.org On Mon, 2004-06-14 at 00:08, Bassam A. Al-Khaffaf wrote: > Dear All, >=20 > I am implementing a Linux box gateway that lunch my own firewall (I > wrote my own iptables rules). The gateway connects two LANs, LAN1: > 192.168.1.0/24 and LAN2: 192.168.0.0/24. LAN1 contains a windows 2000 > server domain controller IP: 192.168.1.231 and LAN2 contains my > clients based on windows xp. >=20 > =20 >=20 > In fact I got stuck on how to forward ONLY and ONLY the NETBIOS > broadcast traffic (03:00:00:00:00:01) from any machine on LAN2 to the > domain controller on LAN1. Take note that the NETBIOS traffic is > carried on IEEE 802.3 Ethernet. >=20 > =20 >=20 > I wrote the following iptable rule, but here all the traffic will be > directed from LAN2 to the domain controller on LAN1 >=20 > Iptables =E2=80=93t nat =E2=80=93A PREROUTING =E2=80=93I eth1 =E2=80=93j = DNAT =E2=80=93to-destination > 192.168.1.231 >=20 > =20 >=20 > So can anybody help me on how can I forward the traffic with > destination MAC address 03:00:00:00:00:01 from LAN2 to the domain > controller (192.168.1.231) on LAN1? >=20 > =20 I have always used some kind of NetBIOS Name Service in a routed environment just so that I do not have to handle the broadcasts. In fact, I usually do this in a large switched environment as well to minimize the broadcast traffic. Where it is absolutely necessary, I have implemented a UDP helper to turn the broadcast packets into unicast packets (similar to DHCP relay). --=20 John A. Sullivan III Chief Technology Officer Nexus Management +1 207-985-7880 john.sullivan@nexusmgmt.com --- If you are interested in helping to develop a GPL enterprise class VPN/Firewall/Security device management console, please visit http://iscs.sourceforge.net=20 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chris Brenton Subject: Re: How to DNAT the only NetBios broadcast traffic (03:00:00:00:00:01)?? Date: Mon, 14 Jun 2004 14:25:39 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1087237538.2010.7.camel@grendel> References: <001b01c451c5$3c734150$1d01a8c0@palettemm.com> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <001b01c451c5$3c734150$1d01a8c0@palettemm.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="windows-1252" To: bassam@palettemm.com Cc: netfilter On Mon, 2004-06-14 at 00:08, Bassam A. Al-Khaffaf wrote: > > In fact I got stuck on how to forward ONLY and ONLY the NETBIOS > broadcast traffic (03:00:00:00:00:01) from any machine on LAN2 to the > domain controller on LAN1. Take note that the NETBIOS traffic is > carried on IEEE 802.3 Ethernet. I think you are confused. _NetBEUI_ transmits to 3:0:0:0:0:01, not NetBIOS/IP. These are NetBEUI _multicasts_, not broadcasts. If you are actually using NetBEUI your options are: 1) bridge the traffic 2) Upgrade to NetBIOS/IP or SMB/IP If you are actually using NetBIOS/IP already, your options are: 1) setup a WINS server 2) create lmhosts entries on the client > I wrote the following iptable rule, but here all the traffic will be > directed from LAN2 to the domain controller on LAN1 >=20 > Iptables =96t nat =96A PREROUTING =96I eth1 =96j DNAT =96to-destination > 192.168.1.231 If you are using NetBEUI, your problem is not iptables. Your problem is you are using a non-routable protocol. As mentioned above, you need to use a bridge or switch over to something IP based. HTH, Chris