How to fill a ipt_entry structure to add a rule using iptc_append_entry()

How to fill a ipt_entry structure to add a rule using iptc_append_entry()

[babula allu]

Hi,


I am trying to add a simple rule to INPUT chain using
iptc_append_entry  but it fails.It says invalid
argument.

 I also tried sending the same ipt_entry structure
which was returned by the iptc_first_rule API.In this
case iptc_append _entry doesn't return an error but
iptables -L doesn't display the rule in the list also.

If somebody knows about the cause and solution please
help me.


thanks
Babula


		
__________________________________
Do you Yahoo!?
Yahoo! Mail is new and improved - Check it out!
http://promotions.yahoo.com/new_mail

configuration again :)

[Krystian]

Hi

I wanted to ask how to configure iptables in my envirement.

The nerwork:

Modem<->Linux Router<->Internal Network

my modem has an ip address of 80.25.25.61
my linux router has a ip address of 80.25.25.62 and a broadcast of 
80.25.25.67.

Puposes:
I want the remaining public ip addresses (80.25.25.63-66)to be mapped 
into couple of Internal Network computers (yes I know it's a nono to do).
How should I configure my box?

Krystian

Re: configuration again :)

[Antony Stone]

On Wednesday 23 June 2004 9:31 am, Krystian wrote:

> Modem<->Linux Router<->Internal Network
>
> my modem has an ip address of 80.25.25.61
> my linux router has a ip address of 80.25.25.62 and a broadcast of
> 80.25.25.67.
>
> Puposes:
> I want the remaining public ip addresses (80.25.25.63-66)to be mapped
> into couple of Internal Network computers.
> How should I configure my box?

Which of the tutorials or HOWTOs at http://www.netfilter.org/documentation 
have you read and had problems in following the advice from?

Regards,

Antony.

-- 
There are only 10 types of people in the world:
those who understand binary notation,
and those who don't.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: configuration again :)

[Antony Stone]

On Wednesday 23 June 2004 1:08 pm, Krystian wrote:

> >Which of the tutorials or HOWTOs at http://www.netfilter.org/documentation
> >have you read and had problems in following the advice from?
>
> Almost all, but I had doubts the configuration i came up with would work.

No harm in trying it to see whether it does, and then asking us a specific 
question if you have problems...  :)

> so teoreticly :)
> for every IP i will need 2 rules for my linux box: one for DNAT'ing
> incomming traffic and one for SNAT'ing outgoing one.

You need a DNAT rule (only) if you want to allow connections *to* the machine 
on your network (reply packets will work automatically).

You do not need an SNAT rule unless you want connections *from* the machine in 
your network to appear from a specific address (otherwise they would get 
handled just the same as any other packets from internal machines to the 
Internet - I presume you have a general-purpose MASQUERADE rule for these).

> but i'm not sure my linux box will receive the traffic destined for
> other ip's in the network without subinterfaces configured to those ip's.

Correct - you have to add the extra public IP addresses which you want the 
firewall to accept packets for (and pass them on to something inside your 
network) to your external interface:

ip addr add 11.22.33.44 dev eth0

etc.

Antony.

-- 
Anything that improbable is effectively impossible.

 - Murray Gell-Mann, Nobel Prizewinner in Physics

                                                     Please reply to the list;
                                                           please don't CC me.

Re: configuration again :)

[Krystian]

>Which of the tutorials or HOWTOs at http://www.netfilter.org/documentation 
>have you read and had problems in following the advice from?
>
>Regards,
>
>Antony.
>  
>
Almost all, but I had doubts the configuration i came up with would work.

so teoreticly :)
for every IP i will need 2 rules for my linux box: one for DNAT'ing 
incomming traffic and one for SNAT'ing outgoing one.
but i'm not sure my linux box will receive the traffic destined for 
other ip's in the network without subinterfaces configured to those ip's.

Krystian