-m helper --helper -irc

-m helper --helper -irc

[Marcin Sura]

Hi

  I use following rule for marking irc dcc transfers from my NATed lan.

  iptables -t mangle -A PREROUTING -p tcp -m helper --helper irc \
  -m mark --mark 0 -j MARK --set-mark 1

  And this works perfectly when I send a file to somebody, and doesn't
  when somebody sends something to me. Why?

  

-- 
Pozdrawiam
 Marcin                         mailto:slacklist@op.pl

Re: -m helper --helper -irc

[Aleksandar Milivojevic]

Marcin Sura wrote:
> Hi
> 
>   I use following rule for marking irc dcc transfers from my NATed lan.
> 
>   iptables -t mangle -A PREROUTING -p tcp -m helper --helper irc \
>   -m mark --mark 0 -j MARK --set-mark 1
> 
>   And this works perfectly when I send a file to somebody, and doesn't
>   when somebody sends something to me. Why?

Not quite sure what you are trying to achieve with above rule.  And hard 
to say what you are doing without looking at the rest of your rules 
(what are those marks used for???).  Why did you need mangle table if 
all you have is simple NATed LAN?

Haven't used irc module, however, taking analogy with ftp module, I 
would probably try something like this (modify to match your network 
configuration):

# I doubt this one is loaded automatically
modprobe ip_nat_irc

# Let assume you implemented masquerading something like this,
# like most people do...
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# IRC is 6666?  Or was it 6667?  Or was it port range?
# Modify as needed...
iptables -A FORWARD -p tcp --sport 1024: --dport 6666 \
    -s 192.168.0.0/16 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp --sport 6666 --dport 1024: \
    -d 192.168.0.0/16 -m state --state ESTABLISHED -j ACCEPT

# DCC.  This works for FTP, I would guess IRC DCC should be the same
iptables -A FORWARD -p tcp --sport 1024: --dport 1024: \
    -m helper --helper irc \
    -m state --state RELATED,ESTABLISHED -j ACCEPT

I assumed that all DCCs are from high ports to high ports (like passive 
FTP data connection).  This example isn't particulary strict.  You may 
make it tighter as needed.

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7

RE: -m helper --helper -irc

[Jason Opperisano]

>   I use following rule for marking irc dcc transfers from my NATed lan.
>
>   iptables -t mangle -A PREROUTING -p tcp -m helper --helper irc \
>   -m mark --mark 0 -j MARK --set-mark 1
>
>   And this works perfectly when I send a file to somebody, and doesn't
>   when somebody sends something to me. Why?

i was under the impression that ip_conntrack_irc was written to handle outbound DCC transfers only...not inbound.  there may be a patch floating around that makes it work inbound as well--try google / marc.theaimsgroup.com/?l=netfilter...

as an aside--what is that rule doing exactly, 'cause you've stumped me.  to me, it says, "if a packet has a mark = 0, set the mark to 1" and you're doing this in the PREROUTING chain of the mangle table--where is the mark = 0 coming from (as i can tell, it could only be coming from a previous rule in mangle:PREROUTING)?

-j