Howto match only the first connection from an IP

Howto match only the first connection from an IP

[Damjan]

My goal is to set-up an iptables rule that will match and DNAT the
first connection from a client. 

The first connection is defined as the first established TCP session 
from the time the iptables rule is inserted. No other TCP connection
should match nor should be DNAT-ed.

Is there any easy way to do this with current Netfilter/Iptables/pom.

(I have installed almost all the patches from pom)


-- 
Damjan Georgievski
jabberID: damjan@bagra.net.mk

Howto match only the first connection from an IP

[Damjan]

My goal is to set-up an iptables rule that will match and DNAT the
first HTTP(port 80) connection from a client (IP address).

The first connection is defined as the first established TCP session 
from the time the iptables rule is inserted. No other TCP connection
should match nor should be DNAT-ed.

Is there any easy way to do this with current Netfilter/Iptables/pom.

(I have installed almost all the patches from pom)


-- 
Damjan Georgievski
jabberID: damjan@bagra.net.mk

Re: Howto match only the first connection from an IP

[Antony Stone]

On Tuesday 18 November 2003 2:43 pm, Damjan wrote:

> My goal is to set-up an iptables rule that will match and DNAT the
> first HTTP(port 80) connection from a client (IP address).
>
> The first connection is defined as the first established TCP session
> from the time the iptables rule is inserted. No other TCP connection
> should match nor should be DNAT-ed.
>
> Is there any easy way to do this with current Netfilter/Iptables/pom.

I can't think of a way to do this with netfilter on its own.

A slightly convoluted, although probably effective, way to do it might be to 
add one rule to LOG the packet you're interested in, and another rule just 
after it to perform the NAT.   You then pipe the output of syslog into a 
script which watches out for the netfilter entry, and then issues a 
"netfilter -D ....." command to delete the NAT rule.

The only flaw I can see here (aside from the inefficiency) is that there will 
be a certain time delay between the first packet being seen and logged, and 
the NAT rule getting deleted by the script, during which time a packet could 
get through on a second connection.

Whether that's important to you, and how long the time period might be, I 
can't say.

It's an idea, anyway.

Antony.

-- 

Mahatma Gandhi was once asked what he thought of Western Civilisation.

He replied, "That would be a very good idea."
                                                     Please reply to the list;
                                                           please don't CC me.

Re: Howto match only the first connection from an IP

[Damjan]

> > My goal is to set-up an iptables rule that will match and DNAT the
> > first HTTP(port 80) connection from a client (IP address).
> >
> > The first connection is defined as the first established TCP session
> > from the time the iptables rule is inserted. No other TCP connection
> > should match nor should be DNAT-ed.
> >
> > Is there any easy way to do this with current Netfilter/Iptables/pom.
> 
> I can't think of a way to do this with netfilter on its own.

Well I've come to this solution, but I wonder how reliable it is

iptables -t nat -p tcp --dport 80 -s 171.68.1.1 -m quota --quota 40 \
    -j REDIRECT --to-ports 9999

This seems to match only the first connection.

Any other ideas???

-- 
Damjan Georgievski
jabberID: damjan@bagra.net.mk

Re: Howto match only the first connection from an IP

[Rodre Ghorashi-Zadeh]

Hello,

I don't think this will work for all traffic, but it should for TCP based 
traffic. Assuming the first packet is a
"SYN" packet, you could try:

iptables -t nat -p tcp --syn --dport 80 -s 171.68.1.1 -m quota --quota 40 \
     -j REDIRECT --to-ports 9999

the key here is the "--syn" flag on the TCP protocol (-p tcp)

Good luck

®odre

>From: Damjan <gdamjan@mail.net.mk>
>To: netfilter@lists.netfilter.org
>Subject: Re: Howto match only the first connection from an IP
>Date: Tue, 18 Nov 2003 18:26:02 +0100
>
> > > My goal is to set-up an iptables rule that will match and DNAT the
> > > first HTTP(port 80) connection from a client (IP address).
> > >
> > > The first connection is defined as the first established TCP session
> > > from the time the iptables rule is inserted. No other TCP connection
> > > should match nor should be DNAT-ed.
> > >
> > > Is there any easy way to do this with current Netfilter/Iptables/pom.
> >
> > I can't think of a way to do this with netfilter on its own.
>
>Well I've come to this solution, but I wonder how reliable it is
>
>iptables -t nat -p tcp --dport 80 -s 171.68.1.1 -m quota --quota 40 \
>     -j REDIRECT --to-ports 9999
>
>This seems to match only the first connection.
>
>Any other ideas???
>
>--
>Damjan Georgievski
>jabberID: damjan@bagra.net.mk
>

_________________________________________________________________
Protect your PC - get McAfee.com VirusScan Online  
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

RE: Howto match only the first connection from an IP

[George Vieira]

patch-o-matic has a ip_limit patch which will not allot more than 1-2-3-XX connections depending on what you set..

Is this what you want?

Thanks,
____________________________________________
George Vieira

> -----Original Message-----
> From: Damjan [mailto:gdamjan@mail.net.mk]
> Sent: Tuesday, 18 November 2003 4:12 PM
> To: netfilter@lists.netfilter.org
> Subject: Howto match only the first connection from an IP
> 
> 
> My goal is to set-up an iptables rule that will match and DNAT the
> first connection from a client. 
> 
> The first connection is defined as the first established TCP session 
> from the time the iptables rule is inserted. No other TCP connection
> should match nor should be DNAT-ed.
> 
> Is there any easy way to do this with current Netfilter/Iptables/pom.
> 
> (I have installed almost all the patches from pom)
> 
> 
> -- 
> Damjan Georgievski
> jabberID: damjan@bagra.net.mk
> 
>