PREROUTING exclude

PREROUTING exclude

[Scott Ainslie]

I want the following rule to work for all machines on my subnet except for 
192.168.0.4. How do I exclude this single machine from this rule?

/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp \
-s 192.168.0.0/24 \
-d 0/0 --dport 80 \
-j DNAT --to 192.168.0.4:3128

_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com

Re: PREROUTING exclude

[Antony Stone]

On Thursday 05 September 2002 1:50 pm, Scott Ainslie wrote:

> I want the following rule to work for all machines on my subnet except for
> 192.168.0.4. How do I exclude this single machine from this rule?
>
> /sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp \
> -s 192.168.0.0/24 \
> -d 0/0 --dport 80 \
> -j DNAT --to 192.168.0.4:3128

Put the following rule before the one above:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -s 192.168.0.4 -j 
ACCEPT

In other words, match the machine you do not want to be translated, and use 
the ACCEPT target to stop processing further rules for this machine.

Antony.

-- 

If at first you don't succeed, destroy all the evidence that you tried.

Re: PREROUTING exclude

[Anders Fugmann]

Scott Ainslie wrote:
> I want the following rule to work for all machines on my subnet except 
> for 192.168.0.4. How do I exclude this single machine from this rule?
> 
> /sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp \
> -s 192.168.0.0/24 \
> -d 0/0 --dport 80 \
> -j DNAT --to 192.168.0.4:3128
> 

The general "all but some" case, can be done by making a new chain, and 
implement fall-through in this chain.

Given the above example you could do:

iptables -t nat -N DNAT_INT
iptables -t nat -A DNAT_INT -s 192.168.0.4 -j RETURN
iptables -t nat -A DNAT_INT -j DNAT --to 192.168.0.4:3128
iptables -t nat -A PREROUTING -s 192.168.0.0/24 --dport 80 -J DNAT_INT

Or somthing in the likes of that. (I removed the -d 0/0, since its 
redundant = default, and I would also suggest adding and interface 
constraint, just to be sure).

Regards
Anders Fugmann

--
Author of FIAIF
FIAIF Is An Intelligent Firewall
http://fiaif.fugmann.dhs.org