* redirect input SYN before forward to QUEUE
@ 2002-06-10 16:19 Francois Chenais
2002-06-10 16:45 ` Francois Chenais
0 siblings, 1 reply; 4+ messages in thread
From: Francois Chenais @ 2002-06-10 16:19 UTC (permalink / raw)
To: netfilter
Hello,
192.168.76.0 192.168.0.0
A --------------> GW_Netfilter --------------------> B
\ /
QUEUE
\
user APP
In fact, I would like to redirect all SYN packet comming from A to B
in target QUEUE for a user space check.
Here what I've done but doesn't work !:-|
on A
-----
route add -net 192.168.0.0 gw GW_Netfilter netmask 255.255.255.0
on GW_Netfilter
---------------
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -A FORWARD -d 192.160.0.0/255.255.255.0 -p tcp --tcp-flags SYN SYN -j QUEUE
iptables -A INPUT -d 192.160.0.0/255.255.255.0 -p tcp --tcp-flags SYN SYN -j QUEUE
user APP connected on hook 1 on the ip_queue
---------------------------------------------
What's wrong ?
Thanks a lot
François
--
Woody 3.0
Linux tanna 2.4.14 #3 SMP Thu Dec 6 14:04:03 CET 2001 i686 unknown
PGP fingerprint : 9AFA 15EC 96C9 F607 EBC1 DD41 70C5 F0E0 25A5 105B
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: redirect input SYN before forward to QUEUE
2002-06-10 16:19 redirect input SYN before forward to QUEUE Francois Chenais
@ 2002-06-10 16:45 ` Francois Chenais
2002-06-11 9:20 ` Francois Chenais
0 siblings, 1 reply; 4+ messages in thread
From: Francois Chenais @ 2002-06-10 16:45 UTC (permalink / raw)
To: netfilter
Now I have put the good rule
iptables -A FORWARD -d 192.168.0.0/255.255.255.0 -p tcp --tcp-flags SYN SYN -j QUEUE
A is connected on B but with his own ip addr instead of the GW_Netfilter addr.
the iptables -t nat -A POSTROUTING -j MASQUERADE seems to be ignored.
Just another (important) information
I use GW_netfilter eth0:0 device to go on network 192.168.0.0
and the eth0:0 device on B so that
A, GW and B are all on the 192.168 network but only GW and B are on the 192.168 one !
192.168.76
.______________.___________________________.
| | |
| | |
| eth0 eth0
| | |
A GW B
| |
eth0:0------192.168.0----------eth0:0
is a better schema !
François
On Mon, 10 Jun 2002 18:19:23 +0200
Francois Chenais <francois@chenais.net> wrote:
| Hello,
|
|
|
| 192.168.76.0 192.168.0.0
| A --------------> GW_Netfilter --------------------> B
| \ /
| QUEUE
| \
| user APP
|
|
|
| In fact, I would like to redirect all SYN packet comming from A to B
| in target QUEUE for a user space check.
|
| Here what I've done but doesn't work !:-|
|
| on A
| -----
| route add -net 192.168.0.0 gw GW_Netfilter netmask 255.255.255.0
|
|
| on GW_Netfilter
| ---------------
| echo 1 > /proc/sys/net/ipv4/ip_forward
| iptables -t nat -A POSTROUTING -j MASQUERADE
| iptables -A FORWARD -d 192.160.0.0/255.255.255.0 -p tcp --tcp-flags SYN SYN -j QUEUE
| iptables -A INPUT -d 192.160.0.0/255.255.255.0 -p tcp --tcp-flags SYN SYN -j QUEUE
|
|
| user APP connected on hook 1 on the ip_queue
| ---------------------------------------------
|
|
| What's wrong ?
|
| Thanks a lot
|
| François
|
| --
| Woody 3.0
| Linux tanna 2.4.14 #3 SMP Thu Dec 6 14:04:03 CET 2001 i686 unknown
|
| PGP fingerprint : 9AFA 15EC 96C9 F607 EBC1 DD41 70C5 F0E0 25A5 105B
|
|
|
|
|
|
|
|
|
|
|
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: redirect input SYN before forward to QUEUE
2002-06-10 16:45 ` Francois Chenais
@ 2002-06-11 9:20 ` Francois Chenais
2002-06-11 12:17 ` Ramin Alidousti
0 siblings, 1 reply; 4+ messages in thread
From: Francois Chenais @ 2002-06-11 9:20 UTC (permalink / raw)
To: netfilter
This works fine with another ethernet card !
will netfilter support eth0:0 interfaces in the future ?
François
On Mon, 10 Jun 2002 18:45:36 +0200
Francois Chenais <francois@chenais.net> wrote:
| Now I have put the good rule
| iptables -A FORWARD -d 192.168.0.0/255.255.255.0 -p tcp --tcp-flags SYN SYN -j QUEUE
|
| A is connected on B but with his own ip addr instead of the GW_Netfilter addr.
| the iptables -t nat -A POSTROUTING -j MASQUERADE seems to be ignored.
|
| Just another (important) information
|
| I use GW_netfilter eth0:0 device to go on network 192.168.0.0
| and the eth0:0 device on B so that
|
| A, GW and B are all on the 192.168 network but only GW and B are on the 192.168 one !
|
|
| 192.168.76
| .______________.___________________________.
| | | |
| | | |
| | eth0 eth0
| | | |
| A GW B
| | |
| eth0:0------192.168.0----------eth0:0
|
|
|
| is a better schema !
|
|
| François
|
|
|
|
|
|
| On Mon, 10 Jun 2002 18:19:23 +0200
| Francois Chenais <francois@chenais.net> wrote:
|
| | Hello,
| |
| |
| |
| | 192.168.76.0 192.168.0.0
| | A --------------> GW_Netfilter --------------------> B
| | \ /
| | QUEUE
| | \
| | user APP
| |
| |
| |
| | In fact, I would like to redirect all SYN packet comming from A to B
| | in target QUEUE for a user space check.
| |
| | Here what I've done but doesn't work !:-|
| |
| | on A
| | -----
| | route add -net 192.168.0.0 gw GW_Netfilter netmask 255.255.255.0
| |
| |
| | on GW_Netfilter
| | ---------------
| | echo 1 > /proc/sys/net/ipv4/ip_forward
| | iptables -t nat -A POSTROUTING -j MASQUERADE
| | iptables -A FORWARD -d 192.160.0.0/255.255.255.0 -p tcp --tcp-flags SYN SYN -j QUEUE
| | iptables -A INPUT -d 192.160.0.0/255.255.255.0 -p tcp --tcp-flags SYN SYN -j QUEUE
| |
| |
| | user APP connected on hook 1 on the ip_queue
| | ---------------------------------------------
| |
| |
| | What's wrong ?
| |
| | Thanks a lot
| |
| | François
| |
| | --
| | Woody 3.0
| | Linux tanna 2.4.14 #3 SMP Thu Dec 6 14:04:03 CET 2001 i686 unknown
| |
| | PGP fingerprint : 9AFA 15EC 96C9 F607 EBC1 DD41 70C5 F0E0 25A5 105B
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
|
|
|
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: redirect input SYN before forward to QUEUE
2002-06-11 9:20 ` Francois Chenais
@ 2002-06-11 12:17 ` Ramin Alidousti
0 siblings, 0 replies; 4+ messages in thread
From: Ramin Alidousti @ 2002-06-11 12:17 UTC (permalink / raw)
To: Francois Chenais; +Cc: netfilter
On Tue, Jun 11, 2002 at 11:20:33AM +0200, Francois Chenais wrote:
> This works fine with another ethernet card !
>
> will netfilter support eth0:0 interfaces in the future ?
The future is already there ;-) Use iproute2 (ip/tc). With "ip" you can
avoid the :0 notation with the same functionality and more...
Besides I thought there was a very small patch which made netfilter to
not choke on ':' or '.' in the interface name. But not sure where to get
the patch... But anyway, use "ip".
Ramin
>
> Fran?ois
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2002-06-11 12:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2002-06-10 16:19 redirect input SYN before forward to QUEUE Francois Chenais
2002-06-10 16:45 ` Francois Chenais
2002-06-11 9:20 ` Francois Chenais
2002-06-11 12:17 ` Ramin Alidousti
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox