PREROUTING

PREROUTING

[Mickael DILY]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi people :-)
I would like to add the following line to my firewall
iptables -A PREROUTING -t mangle -p tcp --sport ssh -j TOS --set-tos\ 
Minimize-Delay
iptables -A PREROUTING -t mangle -p tcp --sport ftp -j TOS --set-tos\ 
Minimize-Delay
iptables -A PREROUTING -t mangle -p tcp --sport ftp -j TOS --set-tos\ 
Maximize-Throughput

When i do this, nothing tells me if it is good or bad. I presume it is good. 
But, when i list my iptables, i see nothing in the rule PREROUTING.
I think it is not normal. Where do i bug  ?
Thanks
- -- 
- - M. DILY, administrateur réseau, geek :-)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE/ayU9zEzekoYhlpsRAtMqAKCsd2oXEK1CQYRR2bbvu2QCUNqy3QCdGbJ5
zmKvWz9TGTGva7hQgZjdqhY=
=Ffgc
-----END PGP SIGNATURE-----

Re: PREROUTING

[Jim Carter]

On Fri, 19 Sep 2003, Mickael DILY wrote:
> I would like to add the following line to my firewall
> iptables -A PREROUTING -t mangle -p tcp --sport ssh -j TOS --set-tos\
> Minimize-Delay
> iptables -A PREROUTING -t mangle -p tcp --sport ftp -j TOS --set-tos\
> Minimize-Delay
> iptables -A PREROUTING -t mangle -p tcp --sport ftp -j TOS --set-tos\
> Maximize-Throughput

I thought you could set only one type of service on a packet.  Did you
perhaps mean "--sport http" in the middle line?  Though given the bloated
advertisement-crammed web pages we often see, maybe "Maximize-Throughput"
would be more appropriate (just joking; each advt. needs a separate
connection and so "Minimize-Delay" is what you want.)

> When i do this, nothing tells me if it is good or bad. I presume it is good.
> But, when i list my iptables, i see nothing in the rule PREROUTING.
> I think it is not normal. Where do i bug  ?

Did you actually list the mangle table with all the special arguments?
E.g. "iptables -t mangle -L -v".

James F. Carter          Voice 310 825 2897    FAX 310 206 6673
UCLA-Mathnet;  6115 MSA; 405 Hilgard Ave.; Los Angeles, CA, USA  90095-1555
Email: jimc@math.ucla.edu    http://www.math.ucla.edu/~jimc (q.v. for PGP key)

PREROUTING

[Chris Percol]

Hi,
I am currently using the following rules on centos iptables to direct
users from a --to-destination to different samba servers.
What is the best approach to take to allow the users of 10.91.0.0 to
also access Samba Server A?

# Samba Server A
/sbin/iptables -t nat -A PREROUTING -p udp --dport 137 -j DNAT
--to-destination 192.168.1.10 --source 10.90.0.0/16
/sbin/iptables -t nat -A PREROUTING -p udp --dport 138 -j DNAT
--to-destination 192.168.1.10 --source 10.90.0.0/16
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 139 -j DNAT
--to-destination 192.168.1.10 --source 10.90.0.0/16
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 445 -j DNAT
--to-destination 192.168.1.10 --source 10.90.0.0/16

# Samba Server B
/sbin/iptables -t nat -A PREROUTING -p udp --dport 137 -j DNAT
--to-destination 192.168.2.10 --source 10.91.0.0/16
/sbin/iptables -t nat -A PREROUTING -p udp --dport 138 -j DNAT
--to-destination 192.168.2.10 --source 10.91.0.0/16
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 139 -j DNAT
--to-destination 192.168.2.10 --source 10.91.0.0/16
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 445 -j DNAT
--to-destination 192.168.2.10 --source 10.91.0.0/16

Thanks,
Chris

Re: PREROUTING

[Andrew Beverley]

On Wed, 2011-10-05 at 12:49 +0100, Chris Percol wrote:
> Hi,
> I am currently using the following rules on centos iptables to direct
> users from a --to-destination to different samba servers.
> What is the best approach to take to allow the users of 10.91.0.0 to
> also access Samba Server A?

I don't understand what you are trying to achieve. There are no
filtering rules below, so anybody trying to access Samba Server A will
be able to do so anyway?

> # Samba Server A
> /sbin/iptables -t nat -A PREROUTING -p udp --dport 137 -j DNAT
> --to-destination 192.168.1.10 --source 10.90.0.0/16
> /sbin/iptables -t nat -A PREROUTING -p udp --dport 138 -j DNAT
> --to-destination 192.168.1.10 --source 10.90.0.0/16
> /sbin/iptables -t nat -A PREROUTING -p tcp --dport 139 -j DNAT
> --to-destination 192.168.1.10 --source 10.90.0.0/16
> /sbin/iptables -t nat -A PREROUTING -p tcp --dport 445 -j DNAT
> --to-destination 192.168.1.10 --source 10.90.0.0/16
> 
> # Samba Server B
> /sbin/iptables -t nat -A PREROUTING -p udp --dport 137 -j DNAT
> --to-destination 192.168.2.10 --source 10.91.0.0/16
> /sbin/iptables -t nat -A PREROUTING -p udp --dport 138 -j DNAT
> --to-destination 192.168.2.10 --source 10.91.0.0/16
> /sbin/iptables -t nat -A PREROUTING -p tcp --dport 139 -j DNAT
> --to-destination 192.168.2.10 --source 10.91.0.0/16
> /sbin/iptables -t nat -A PREROUTING -p tcp --dport 445 -j DNAT
> --to-destination 192.168.2.10 --source 10.91.0.0/16
> 
> Thanks,
> Chris
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

PREROUTING

[netfilter_user]

Hello everyone,

this is my problem:
My LAN is connected to Internet via Linux machine with 2 interface (
ppp0 - for internet and eth1 for local net). I need to connect from
local host, service that is running on port 23073 and 23083 UDP in
internet. For this i wrote afew rules with PREROUTING but when I start
script with rules below i receive:

Bad argument `PREROUTING'
Try `iptables -h' or 'iptables --help' for more information.
Bad argument `PREROUTING'
Try `iptables -h' or 'iptables --help' for more information.


iptables -t nat -A PREROUTING -p udp -d 80.50.60.185 --dport 23073 -j DNAT --to-destination 192.168.1.2
iptables -t nat -A PREROUTING -p udp -d 80.50.60.185 --dport 23083 -j DNAT --to-destination 192.168.1.2

iptables -A FORWARD -p udp -d 192.168.1.2 --dport 23073 -j ACCEPT
iptables -A FORWARD -p udp -d 192.168.1.2 --dport 23083 -j ACCEPT

What maybe a reason of this msg?
Im using slackware 8.1 with iptables 1.2.6a

-- 
Best regards,
  mailto:netfilter_user@o2.pl

Re: PREROUTING

[SaVaGE]

Op dinsdag 29 april 2003 09:23, schreef netfilter_user:
> Hello everyone,
>
> this is my problem:
> My LAN is connected to Internet via Linux machine with 2 interface (
> ppp0 - for internet and eth1 for local net). I need to connect from
> local host, service that is running on port 23073 and 23083 UDP in
> internet. For this i wrote afew rules with PREROUTING but when I start
> script with rules below i receive:
>
> Bad argument `PREROUTING'
> Try `iptables -h' or 'iptables --help' for more information.
> Bad argument `PREROUTING'
> Try `iptables -h' or 'iptables --help' for more information.
>
>
> iptables -t nat -A PREROUTING -p udp -d 80.50.60.185 --dport 23073 -j DNAT
> --to-destination 192.168.1.2 iptables -t nat -A PREROUTING -p udp -d
> 80.50.60.185 --dport 23083 -j DNAT --to-destination 192.168.1.2
>
> iptables -A FORWARD -p udp -d 192.168.1.2 --dport 23073 -j ACCEPT
> iptables -A FORWARD -p udp -d 192.168.1.2 --dport 23083 -j ACCEPT
>
> What maybe a reason of this msg?
> Im using slackware 8.1 with iptables 1.2.6a

This behaviour is correct NATting is done on the POSTROUTING table !!!!


Pascal (PC-Secure Dutch security service)

Re: PREROUTING

[Frederic Gobin]

This is not really true ...

According to the iptables man page, DNAT is valid only in the OUTPUT 
and PREROUTING chain of the nat table. SNAT is only valid in the 
POSTROUTING chain of the nat table.

It could be a missing kernel option ...

Frederic Gobin

Am Dienstag, 29.04.03 um 09:49 Uhr schrieb SaVaGE:

> Op dinsdag 29 april 2003 09:23, schreef netfilter_user:
>> Hello everyone,
>>
>> this is my problem:
>> My LAN is connected to Internet via Linux machine with 2 interface (
>> ppp0 - for internet and eth1 for local net). I need to connect from
>> local host, service that is running on port 23073 and 23083 UDP in
>> internet. For this i wrote afew rules with PREROUTING but when I start
>> script with rules below i receive:
>>
>> Bad argument `PREROUTING'
>> Try `iptables -h' or 'iptables --help' for more information.
>> Bad argument `PREROUTING'
>> Try `iptables -h' or 'iptables --help' for more information.
>>
>>
>> iptables -t nat -A PREROUTING -p udp -d 80.50.60.185 --dport 23073 -j 
>> DNAT
>> --to-destination 192.168.1.2 iptables -t nat -A PREROUTING -p udp -d
>> 80.50.60.185 --dport 23083 -j DNAT --to-destination 192.168.1.2
>>
>> iptables -A FORWARD -p udp -d 192.168.1.2 --dport 23073 -j ACCEPT
>> iptables -A FORWARD -p udp -d 192.168.1.2 --dport 23083 -j ACCEPT
>>
>> What maybe a reason of this msg?
>> Im using slackware 8.1 with iptables 1.2.6a
>
> This behaviour is correct NATting is done on the POSTROUTING table !!!!
>
>
> Pascal (PC-Secure Dutch security service)
>

Re: PREROUTING

[Eric Poulin]

You are absolutly right. Actually, the command is correct, and also working
fine in my environement, so I suspect also that some options by be missing in
the kernel.

Eric


> This is not really true ...
>
> According to the iptables man page, DNAT is valid only in the OUTPUT
> and PREROUTING chain of the nat table. SNAT is only valid in the
> POSTROUTING chain of the nat table.
>
> It could be a missing kernel option ...
>
> Frederic Gobin
>
> Am Dienstag, 29.04.03 um 09:49 Uhr schrieb SaVaGE:
>
> > Op dinsdag 29 april 2003 09:23, schreef netfilter_user:
> >> Hello everyone,
> >>
> >> this is my problem:
> >> My LAN is connected to Internet via Linux machine with 2 interface (
> >> ppp0 - for internet and eth1 for local net). I need to connect from
> >> local host, service that is running on port 23073 and 23083 UDP in
> >> internet. For this i wrote afew rules with PREROUTING but when I start
> >> script with rules below i receive:
> >>
> >> Bad argument `PREROUTING'
> >> Try `iptables -h' or 'iptables --help' for more information.
> >> Bad argument `PREROUTING'
> >> Try `iptables -h' or 'iptables --help' for more information.
> >>
> >>
> >> iptables -t nat -A PREROUTING -p udp -d 80.50.60.185 --dport 23073 -j
> >> DNAT
> >> --to-destination 192.168.1.2 iptables -t nat -A PREROUTING -p udp -d
> >> 80.50.60.185 --dport 23083 -j DNAT --to-destination 192.168.1.2
> >>
> >> iptables -A FORWARD -p udp -d 192.168.1.2 --dport 23073 -j ACCEPT
> >> iptables -A FORWARD -p udp -d 192.168.1.2 --dport 23083 -j ACCEPT
> >>
> >> What maybe a reason of this msg?
> >> Im using slackware 8.1 with iptables 1.2.6a
> >
> > This behaviour is correct NATting is done on the POSTROUTING table !!!!
> >
> >
> > Pascal (PC-Secure Dutch security service)
> >
>
>
>
>