Re: redirect a HTTP-connection only once

[Joel Newkirk <netfilter@newkirk.us>]

On Friday 15 November 2002 03:28 pm, Karl Gruber wrote:
> Hi!
>
> I want to know if it is possible that an iptables-rule matches only once. I
> want to implement a redirection of the first http-request of an user.
>
> thanx,
>      Karl

disclaimer - I've never done this before...

Do you mean the first ever (IE only catch one, then never again) or the first 
to a given destination, or what? 

Matching TCP80 from a user with state NEW and TCP flag SYN without ACK or RST 
should catch the initial HTTP request in a given transaction, and repeat 
every time a new request is initiated.  I believe a LIMIT match (1/day) with 
no burst watching for these would catch only the first HTTP transaction 
requested by a user each day. (or until the firewall is reset, whichever is 
sooner)  

But the packet itself will probably be effectively lost if you redirect only 
the first, leaving the client to re-request.  If you divert a single packet 
then reinsert it somehow, I think netfilter will not properly handle 
forwarding of subsequent packets that are part of the transaction.

Something like:

/sbin/iptables -A FORWARD -s w.x.y.z -p tcp --dport 80 --state NEW --tcp-flags 
SYN,RST,ACK SYN -m limit --limit 1/day --limit-burst 1 -j {whatever target}

Should match ONLY the first request from w.x.y.z for an HTTP connection per 
day.  Would that suit your use?

j