From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Krish Ahya" Subject: Question Date: Fri, 21 Jun 2002 12:33:15 -0500 Sender: netfilter-admin@lists.samba.org Message-ID: <004001c21949$b966bc20$0201a8c0@power> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_003D_01C2191F.D05B2530" Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.samba.org This is a multi-part message in MIME format. ------=_NextPart_000_003D_01C2191F.D05B2530 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi all, I was just wondering, is Netfilter as good as Cisco's PIX and = Checkpoint's Firewall-1, if not better? Also I'm wondering say if I have a dmz and allow people to come into a = server on port 80, will netfilter inspect the packet on all 7 layers of = the OSI model and make sure that it is actually a http packet and = following the rules and protocol specifications of http? Sorta like = checkpoints INSPECT module. Thanks. - Krish ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~ I have not failed 10,000 times, I have sucessfully found 10,000 ways = that won't work." -- Thomas A. Edison ------=_NextPart_000_003D_01C2191F.D05B2530 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi all,

I was just wondering, is Netfilter as = good as=20 Cisco's PIX and Checkpoint's Firewall-1, if not better?

Also I'm wondering say if I have a dmz = and allow=20 people to come into a server on port 80, will netfilter inspect the = packet on=20 all 7 layers of the OSI model and make sure that it is actually a http = packet=20 and following the rules and protocol specifications of http? Sorta like=20 checkpoints INSPECT module.

Thanks.

- Krish

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
I have not=20 failed 10,000 times, I have sucessfully found 10,000 ways that won't = work." --=20 Thomas A. Edison

------=_NextPart_000_003D_01C2191F.D05B2530-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: Question Date: Fri, 21 Jun 2002 18:40:59 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <20020621174102.NJXP2755.mta05-svc.ntlworld.com@there> References: <004001c21949$b966bc20$0201a8c0@power> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <004001c21949$b966bc20$0201a8c0@power> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Friday 21 June 2002 6:33 pm, Krish Ahya wrote: > Hi all, > > I was just wondering, is Netfilter as good as Cisco's PIX and Checkpoint's > Firewall-1, if not better? Yes. > Also I'm wondering say if I have a dmz and allow people to come into a > server on port 80, will netfilter inspect the packet on all 7 layers of the > OSI model and make sure that it is actually a http packet and following the > rules and protocol specifications of http? No. At least one of the above answers is merely my personal opinion. Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "James Mello" Subject: RE: Question Date: Fri, 21 Jun 2002 11:31:29 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <000401c21951$dcd11310$8147370a@washingtghv9lt> References: <20020621174102.NJXP2755.mta05-svc.ntlworld.com@there> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20020621174102.NJXP2755.mta05-svc.ntlworld.com@there> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'Antony Stone' , netfilter@lists.samba.org > > Also I'm wondering say if I have a dmz and allow people to > come into a > > server on port 80, will netfilter inspect the packet on all > 7 layers > > of the OSI model and make sure that it is actually a http > packet and > > following the rules and protocol specifications of http? No, but there are experimental modules that will allow you to enforce your own rules. I've heard of some IDS or attack detection capabilities being done through IP tables. -- Cheers -- James From mboxrd@z Thu Jan 1 00:00:00 1970 From: Nick Drage Subject: Re: Question Date: Fri, 21 Jun 2002 19:59:52 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <20020621195952.C2957@funkyjesus.org> References: <004001c21949$b966bc20$0201a8c0@power> Reply-To: Nick Drage Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <004001c21949$b966bc20$0201a8c0@power>; from Krish@houston.rr.com on Fri, Jun 21, 2002 at 12:33:15PM -0500 Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.samba.org On Fri, Jun 21, 2002 at 12:33:15PM -0500, Krish Ahya wrote: > Hi all, > > I was just wondering, is Netfilter as good as Cisco's PIX and Checkpoint's > Firewall-1, if not better? Depends what you mean by "good", which is a little too general to rate something as complex as a firewall. In relation to Firewall-1 it is cheaper, it is possibly as efficient and as secure ( with the right configuration ), configuration is more difficult IMHO... and all that depends on the situation you're using it and the skill of the administrators. At the least it's free to try... :) -- FunkyJesus System Administration Team From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Rowan Reid" Subject: RE: Question Date: Fri, 21 Jun 2002 12:41:38 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <000001c2195b$a91773c0$6b01a8c0@s3ac> References: <20020621195952.C2957@funkyjesus.org> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20020621195952.C2957@funkyjesus.org> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org >>At the least it's free to try... :) Does anyone know where to find documentation for Firewall-1 I decided to try it once but couldn't find any documentation to save my life. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: Question Date: Sat, 22 Jun 2002 00:12:28 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <20020621231230.XKAD19225.mta07-svc.ntlworld.com@there> References: <000401c21951$dcd11310$8147370a@washingtghv9lt> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <000401c21951$dcd11310$8147370a@washingtghv9lt> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Friday 21 June 2002 7:31 pm, James Mello wrote: > > Also I'm wondering say if I have a dmz and allow people to come into a > > server on port 80, will netfilter inspect the packet on all 7 layers > > of the OSI model and make sure that it is actually a http packet and > > following the rules and protocol specifications of http? > > No, but there are experimental modules that will allow you to enforce > your own rules. I've heard of some IDS or attack detection capabilities > being done through IP tables. What sort of modules ? I *hope* you don't mean the 'string' match ? I'm not aware of anything based on IPtables which makes an effective (OSI layer 7) IDS - it's just not designed for it, being a packet filter..... Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "James Mello" Subject: RE: Question Date: Fri, 21 Jun 2002 16:16:45 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <001c01c21979$b6b61a40$8147370a@washingtghv9lt> References: <20020621231230.XKAD19225.mta07-svc.ntlworld.com@there> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20020621231230.XKAD19225.mta07-svc.ntlworld.com@there> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'Antony Stone' , netfilter@lists.samba.org > > No, but there are experimental modules that will allow you > to enforce > > your own rules. I've heard of some IDS or attack detection > > capabilities being done through IP tables. > > What sort of modules ? I *hope* you don't mean the 'string' match ? Yeah, I actually do mean the 'string' match :) I've got some friends who used this to do some filtering on content on their own internet exposed boxes to prevent stupid Nimda worm and other attacks from being perpetrated. They *did* say it was slow, but overall it's been a pretty effective solution for them. Note I *never* did say that you can do all sorts of Layer 7 evaluation (or validation) like the guy said. I just suggested this as an option to do some layer 7 filtering and content checking... -- Cheers -- James From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: Question Date: Sat, 22 Jun 2002 00:26:46 +0100 Sender: netfilter-admin@lists.samba.org Message-ID: <20020621232648.KUCK4626.mta02-svc.ntlworld.com@there> References: <001c01c21979$b6b61a40$8147370a@washingtghv9lt> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <001c01c21979$b6b61a40$8147370a@washingtghv9lt> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.samba.org On Saturday 22 June 2002 12:16 am, James Mello wrote: > > > No, but there are experimental modules that will allow you to enforce > > > your own rules. I've heard of some IDS or attack detection > > > capabilities being done through IP tables. > > > > What sort of modules ? I *hope* you don't mean the 'string' match ? > > Yeah, I actually do mean the 'string' match :) I've got some friends who > used this to do some filtering on content on their own internet exposed > boxes to prevent stupid Nimda worm and other attacks from being > perpetrated. Hmmm. Okay, I'll agree you can do a certain amount of string matching, with a certain degree of reliability, wiht this module, but I think for an IDS I'd rather go for snort / hogwash. Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Sascha Reissner" Subject: Re: Question Date: Sat, 22 Jun 2002 02:26:26 +0200 Sender: netfilter-admin@lists.samba.org Message-ID: <001201c21983$724d3d70$11c810ac@honor> References: <004001c21949$b966bc20$0201a8c0@power> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Krish Ahya , netfilter@lists.samba.org From: Krish Ahya > I was just wondering, is Netfilter as good as Cisco's PIX and Checkpoint's Firewall-1, if not better? its hard to compare apples with pears.. one is a firewalling system.. netfilter is more or less a packet filter.... > Also I'm wondering say if I have a dmz and allow people to come into a server on port 80, will netfilter inspect the packet on all > 7 layers of the OSI model and make sure that it is actually a http packet and following the rules and protocol specifications of > http? Sorta like checkpoints INSPECT module. as netfilter is "only" a packet filter (with some additional modules to provide more functions) you will stick with stuff like string match and all modules you would like to provide the netfilter community (if you code them yourself) From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jack Bowling Subject: Re: Question Date: Fri, 21 Jun 2002 19:11:28 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <0GY3001U64R6B2@l-daemon> References: <000401c21951$dcd11310$8147370a@washingtghv9lt> <20020621231230.XKAD19225.mta07-svc.ntlworld.com@there> Reply-To: Jack Bowling Mime-Version: 1.0 Content-Transfer-Encoding: 7BIT Return-path: In-Reply-To: <20020621231230.XKAD19225.mta07-svc.ntlworld.com@there> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: TEXT/PLAIN; charset="us-ascii" To: netfilter@lists.samba.org ** Reply to message from Antony Stone on Sat, 22 Jun 2002 00:12:28 +0100 > On Friday 21 June 2002 7:31 pm, James Mello wrote: > > > > Also I'm wondering say if I have a dmz and allow people to come into a > > > server on port 80, will netfilter inspect the packet on all 7 layers > > > of the OSI model and make sure that it is actually a http packet and > > > following the rules and protocol specifications of http? > > > > No, but there are experimental modules that will allow you to enforce > > your own rules. I've heard of some IDS or attack detection capabilities > > being done through IP tables. > > What sort of modules ? I *hope* you don't mean the 'string' match ? > > I'm not aware of anything based on IPtables which makes an effective (OSI > layer 7) IDS - it's just not designed for it, being a packet filter..... There is the psd module. Check it out. jb -- Jack Bowling mailto: jbinpg@shaw.ca From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Frost Subject: Re: Question Date: Sat, 22 Jun 2002 11:25:48 -0400 Sender: netfilter-admin@lists.samba.org Message-ID: <20020622152548.GQ9519@ns> References: <000401c21951$dcd11310$8147370a@washingtghv9lt> <20020621231230.XKAD19225.mta07-svc.ntlworld.com@there> <0GY3001U64R6B2@l-daemon> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="PLQVj6KKQ8ndgLWn" Return-path: Content-Disposition: inline In-Reply-To: <0GY3001U64R6B2@l-daemon> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Jack Bowling Cc: netfilter@lists.samba.org --PLQVj6KKQ8ndgLWn Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable * Jack Bowling (jbinpg@shaw.ca) wrote: > ** Reply to message from Antony Stone on Sa= t, 22 Jun 2002 00:12:28 +0100 > > What sort of modules ? I *hope* you don't mean the 'string' match ? > >=20 > > I'm not aware of anything based on IPtables which makes an effective (O= SI=20 > > layer 7) IDS - it's just not designed for it, being a packet filter..... >=20 > There is the psd module. Check it out. There's also my recent module, just to throw it in there. :) Stephen --PLQVj6KKQ8ndgLWn Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE9FJb8rzgMPqB3kigRAtIeAJ4uJ1uekSP38xbiwCiecbeCq37YHQCgiH+e AGhOVh7B4jw2qPGPZFbFF0w= =DFxI -----END PGP SIGNATURE----- --PLQVj6KKQ8ndgLWn-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ramin Alidousti Subject: Re: Question Date: Sat, 22 Jun 2002 11:42:48 -0400 Sender: netfilter-admin@lists.samba.org Message-ID: <20020622154248.GA8126@cannon.eng.us.uu.net> References: <000401c21951$dcd11310$8147370a@washingtghv9lt> <20020621231230.XKAD19225.mta07-svc.ntlworld.com@there> <0GY3001U64R6B2@l-daemon> <20020622152548.GQ9519@ns> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <20020622152548.GQ9519@ns> Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Jack Bowling , netfilter@lists.samba.org On Sat, Jun 22, 2002 at 11:25:48AM -0400, Stephen Frost wrote: > > > I'm not aware of anything based on IPtables which makes an effective (OSI > > > layer 7) IDS - it's just not designed for it, being a packet filter..... > > > > There is the psd module. Check it out. > > There's also my recent module, just to throw it in there. :) Which IMHO is much _more_ powerful :-) Ramin > Stephen From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sander Sneekes Subject: question Date: 12 Jun 2003 22:41:54 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1055450513.3204.12.camel@localhost.localdomain> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Netfilter Hi all, Small qeustion anybody have any clue howto get microsoft netmeeting to work from behind an iptables firewall? I'm able to accept a conf. en send text but no video/audio cheers Sander From mboxrd@z Thu Jan 1 00:00:00 1970 From: "George Vieira" Subject: RE: question Date: Fri, 13 Jun 2003 08:11:17 +1000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <09B04A55822EFF4DA48D2E0BB2941D4A0D6E85@wardrive.citadelcomputer.com.au> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Sander Sneekes , Netfilter Look in the archives yet? Done a google search? Use the H323 patch from patch-o-matic. Thanks, ____________________________________________ George Vieira Systems Manager georgev@citadelcomputer.com.au Citadel Computer Systems Pty Ltd http://www.citadelcomputer.com.au -----Original Message----- From: Sander Sneekes [mailto:sander@dmdsecure.com] Sent: Friday, June 13, 2003 6:42 AM To: Netfilter Subject: question Hi all, Small qeustion anybody have any clue howto get=20 microsoft netmeeting to work from behind an iptables firewall? I'm able to accept a conf. en send text but no video/audio cheers Sander From mboxrd@z Thu Jan 1 00:00:00 1970 From: "emiliano" Subject: question Date: Thu, 25 Sep 2003 11:04:24 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000001c3836d$ed89f0a0$191d29c8@soporte> Reply-To: emiliano@amc.com.ar Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01C38354.C83E3F40" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0001_01C38354.C83E3F40 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, could you give me some help about the question below? =20 I have a Total Control with a private pool of IPs. I=92m using IPTables = with NAT and HT23 modules. My trouble is that while I get a perfect video = stream, I=92m unable to transmitt/receive audio (through the instant Messenger = from Microsoft, MSN Messenger ).=20 =20 Some sugesti=F3n about? I really will be greateful with you if you can = give me some idea =85 =20 Thanks!!=20 =20 Best regards =20 Emiliano Barbat Argentina ------=_NextPart_000_0001_01C38354.C83E3F40 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi, could you give me some help about the question = below?

I have=A0 a Total Control with a private pool of IPs. = I’m using IPTables with NAT and HT23 modules. My trouble is that while I get = a perfect video stream, I’m unable to transmitt/receive audio (through the = instant Messenger from Microsoft, MSN Messenger ).

Some sugesti=F3n about? I really will be greateful = with you if you can give me some idea …

Thanks!!

Best regards

Emiliano Barbat

Argentina

------=_NextPart_000_0001_01C38354.C83E3F40-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcin Giedz Subject: question Date: Thu, 27 Oct 2005 09:55:20 +0200 Message-ID: <200510270955.20466.marcin.giedz@eulerhermes.pl> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Hi, I'd like to ask if it possible to change "data" field (its content) in TCP packet on fly? I don't need to change data's lenght but only change few bytes in it. Example: 0000 ff ff ff ff ff ff 00 11 25 31 ad e0 08 00 45 00 ........%1....E. 0010 00 c1 0a b1 00 00 80 11 82 0f ac 13 01 59 ff ff .............Y.. 0020 ff ff 04 2d 01 db 00 ad 60 78 ad a7 5b de 9f 26 ...-....`x..[..& 0030 ec 98 2d 26 ec 18 2d 26 ec 18 2d 26 ec 18 2d 26 ..-&..-&..-&..-& 0040 ec 18 2d 26 ec 18 2d 26 ec 18 2d 26 ec 18 2d 26 ..-&..-&..-&..-& First line contains MAC address 00:11:25:31:ad:e0 - I need to change it to other value. Is it possible at all? Marcin From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ruprecht Helms Subject: Re: question Date: Thu, 27 Oct 2005 10:18:49 +0200 Message-ID: <43608D69.30001@my-mail.ch> References: <200510270955.20466.marcin.giedz@eulerhermes.pl> Reply-To: rhelms@my-mail.ch Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200510270955.20466.marcin.giedz@eulerhermes.pl> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Marcin Giedz Cc: netfilter@lists.netfilter.org Hi Marcin, > > I'd like to ask if it possible to change "data" field (its content) in TCP > packet on fly? I don't need to change data's lenght but only change few bytes > in it. > > Example: > 0000 ff ff ff ff ff ff 00 11 25 31 ad e0 08 00 45 00 ........%1....E. much you can do with tcpdump. Regards, Ruprecht ------------------------------------------------------------------------------------------ Ruprecht Helms IT-Service & Softwareentwicklung Tel./Fax +49[0]7621 16 99 16 Web: htp://www.rheyn.de From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcin Giedz Subject: Re: question Date: Thu, 27 Oct 2005 10:39:16 +0200 Message-ID: <200510271039.16458.marcin.giedz@eulerhermes.pl> References: <200510270955.20466.marcin.giedz@eulerhermes.pl> <43608D69.30001@my-mail.ch> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <43608D69.30001@my-mail.ch> Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1" To: rhelms@my-mail.ch Cc: netfilter@lists.netfilter.org Dnia czwartek, 27 pa=BCdziernika 2005 10:18, Ruprecht Helms napisa=B3: > Hi Marcin, > > > I'd like to ask if it possible to change "data" field (its content) in > > TCP packet on fly? I don't need to change data's lenght but only change > > few bytes in it. > > > > Example: > > 0000 ff ff ff ff ff ff 00 11 25 31 ad e0 08 00 45 00 ........%1....E. > > much you can do with tcpdump. I don't get it :( How with tcpdump as tcpdump is only dump traffic tool - as I know it can't= =20 change anything or I'm wrong? Marcin > > Regards, > Ruprecht > > -------------------------------------------------------------------------= =2D- >--------------- Ruprecht Helms IT-Service & Softwareentwicklung > > Tel./Fax +49[0]7621 16 99 16 > Web: htp://www.rheyn.de From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ruprecht Helms Subject: Re: question Date: Thu, 27 Oct 2005 11:09:15 +0200 Message-ID: <4360993B.5060500@my-mail.ch> References: <200510270955.20466.marcin.giedz@eulerhermes.pl> <43608D69.30001@my-mail.ch> <200510271039.16458.marcin.giedz@eulerhermes.pl> Reply-To: rhelms@my-mail.ch Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200510271039.16458.marcin.giedz@eulerhermes.pl> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Marcin Giedz Cc: netfilter@lists.netfilter.org Marcin Giedz wrote: > > I don't get it :( > How with tcpdump as tcpdump is only dump traffic tool - as I know it can't > change anything or I'm wrong? You are right. As I know it only dump. What you need is a hexeditor or you are looking for a tool that do hexediting in the fly. But that is offtopic in this list. Regards, Ruprecht From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sorin Panca Subject: Re: question Date: Thu, 27 Oct 2005 12:28:02 +0300 Message-ID: <43609DA2.8050301@gmail.com> References: <200510270955.20466.marcin.giedz@eulerhermes.pl> <43608D69.30001@my-mail.ch> <200510271039.16458.marcin.giedz@eulerhermes.pl> <4360993B.5060500@my-mail.ch> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4360993B.5060500@my-mail.ch> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Ruprecht Helms wrote: > Marcin Giedz wrote: > >> >> I don't get it :( >> How with tcpdump as tcpdump is only dump traffic tool - as I know it >> can't change anything or I'm wrong? > > > You are right. As I know it only dump. > What you need is a hexeditor or you are looking for a tool that do > hexediting in the fly. > > But that is offtopic in this list. I think he needs a packet mangling tool: he's not offtopic. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcin Giedz Subject: Re: question Date: Thu, 27 Oct 2005 11:40:34 +0200 Message-ID: <200510271140.34417.marcin.giedz@eulerhermes.pl> References: <200510270955.20466.marcin.giedz@eulerhermes.pl> <200510271039.16458.marcin.giedz@eulerhermes.pl> <4360993B.5060500@my-mail.ch> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <4360993B.5060500@my-mail.ch> Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1" To: rhelms@my-mail.ch Cc: netfilter@lists.netfilter.org Dnia czwartek, 27 pa=BCdziernika 2005 11:09, Ruprecht Helms napisa=B3: > Marcin Giedz wrote: > > I don't get it :( > > How with tcpdump as tcpdump is only dump traffic tool - as I know it > > can't change anything or I'm wrong? > > You are right. As I know it only dump. > What you need is a hexeditor or you are looking for a tool that do > hexediting in the fly. Absolutely!=20 > > But that is offtopic in this list. But I really don't know where to start? Perhaps some did it earlier. Marcin > > Regards, > Ruprecht From mboxrd@z Thu Jan 1 00:00:00 1970 From: Oskar Andreasson Subject: Re: question Date: Thu, 27 Oct 2005 12:04:50 +0200 Message-ID: <1130407490.8832.10.camel@laptop3> References: <200510270955.20466.marcin.giedz@eulerhermes.pl> <200510271039.16458.marcin.giedz@eulerhermes.pl> <4360993B.5060500@my-mail.ch> <200510271140.34417.marcin.giedz@eulerhermes.pl> Reply-To: oan@frozentux.net Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-sKKvN7eSLnxAiWvkDTfG" Return-path: In-Reply-To: <200510271140.34417.marcin.giedz@eulerhermes.pl> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org To: Marcin Giedz Cc: netfilter@lists.netfilter.org --=-sKKvN7eSLnxAiWvkDTfG Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Marcin,=20 iptables and netfilter will not do the job, unless you are willing to sacrifice stability and security. The problem is that the strings that netfilter will see are broken down into smaller pieces. So the string "iptables and netfilter" might actually be transmitted as "iptables and" and then "netfilter" in a separate packet. On top of this, people might try to intentionally break your filters by fragmenting the above string into "i", "p", "t", ... etc packets.=20 The good thing to do in this case, is to wait until the TCP stream has reached the application layer and has been reassembled properly. Hence, you will want to either write your own proxy, or to use someone elses proxy.=20 If you want to use it, I just uploaded a tunnel/proxy program to http://www.frozentux.net/stunnel.tgz. This is an unfinished program I started on a couple of years ago. It is written in C. It is horribly coded and pretty much sucks, but it has no memory leaks and might serve as a starting point. Have a nice day;). On Thu, 2005-10-27 at 11:40 +0200, Marcin Giedz wrote: > Dnia czwartek, 27 pa=C5=BAdziernika 2005 11:09, Ruprecht Helms napisa=C5= =82: > > Marcin Giedz wrote: > > > I don't get it :( > > > How with tcpdump as tcpdump is only dump traffic tool - as I know it > > > can't change anything or I'm wrong? > > > > You are right. As I know it only dump. > > What you need is a hexeditor or you are looking for a tool that do > > hexediting in the fly. >=20 > Absolutely!=20 >=20 > > > > But that is offtopic in this list. >=20 > But I really don't know where to start? Perhaps some did it earlier. >=20 > Marcin >=20 > > > > Regards, > > Ruprecht >=20 --=-sKKvN7eSLnxAiWvkDTfG Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQBDYKZCGadwPDPpB60RAjHjAJ0aXCiY21jjjVHWq1vO4yb+XtoO8QCfS2uV o2WlMUNHUl2o7rcaZyhaJ/8= =wdr7 -----END PGP SIGNATURE----- --=-sKKvN7eSLnxAiWvkDTfG-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcin Giedz Subject: Re: question Date: Thu, 27 Oct 2005 12:25:49 +0200 Message-ID: <200510271225.50084.marcin.giedz@eulerhermes.pl> References: <200510270955.20466.marcin.giedz@eulerhermes.pl> <200510271140.34417.marcin.giedz@eulerhermes.pl> <1130407490.8832.10.camel@laptop3> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <1130407490.8832.10.camel@laptop3> Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1" To: oan@frozentux.net Cc: netfilter@lists.netfilter.org Dnia czwartek, 27 pa=BCdziernika 2005 12:04, Oskar Andreasson napisa=B3: > Hi Marcin, > > iptables and netfilter will not do the job, unless you are willing to > sacrifice stability and security. The problem is that the strings that > netfilter will see are broken down into smaller pieces. So the string > "iptables and netfilter" might actually be transmitted as "iptables and" > and then "netfilter" in a separate packet. On top of this, people might > try to intentionally break your filters by fragmenting the above string > into "i", "p", "t", ... etc packets. > > The good thing to do in this case, is to wait until the TCP stream has > reached the application layer and has been reassembled properly. Hence, > you will want to either write your own proxy, or to use someone elses > proxy. > > If you want to use it, I just uploaded a tunnel/proxy program to > http://www.frozentux.net/stunnel.tgz. This is an unfinished program I > started on a couple of years ago. It is written in C. It is horribly > coded and pretty much sucks, but it has no memory leaks and might serve > as a starting point. Great!!! Really thanks but I just can't reach your program - above address= =20 doesn't work :( Could you please do something or send the program on my=20 private mail. Thanks once again, Marcin > > Have a nice day;). > > On Thu, 2005-10-27 at 11:40 +0200, Marcin Giedz wrote: > > Dnia czwartek, 27 pa=BCdziernika 2005 11:09, Ruprecht Helms napisa=B3: > > > Marcin Giedz wrote: > > > > I don't get it :( > > > > How with tcpdump as tcpdump is only dump traffic tool - as I know it > > > > can't change anything or I'm wrong? > > > > > > You are right. As I know it only dump. > > > What you need is a hexeditor or you are looking for a tool that do > > > hexediting in the fly. > > > > Absolutely! > > > > > But that is offtopic in this list. > > > > But I really don't know where to start? Perhaps some did it earlier. > > > > Marcin > > > > > Regards, > > > Ruprecht From mboxrd@z Thu Jan 1 00:00:00 1970 From: Oskar Andreasson Subject: Re: question Date: Thu, 27 Oct 2005 12:37:39 +0200 Message-ID: <1130409459.8832.15.camel@laptop3> References: <200510270955.20466.marcin.giedz@eulerhermes.pl> <200510271140.34417.marcin.giedz@eulerhermes.pl> <1130407490.8832.10.camel@laptop3> <200510271225.50084.marcin.giedz@eulerhermes.pl> Reply-To: oan@frozentux.net Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-PYIb63wQYb++o214s/hL" Return-path: In-Reply-To: <200510271225.50084.marcin.giedz@eulerhermes.pl> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org To: Marcin Giedz Cc: netfilter@lists.netfilter.org --=-PYIb63wQYb++o214s/hL Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On Thu, 2005-10-27 at 12:25 +0200, Marcin Giedz wrote: > Dnia czwartek, 27 pa=C5=BAdziernika 2005 12:04, Oskar Andreasson napisa= =C5=82: > > Hi Marcin, > > > > iptables and netfilter will not do the job, unless you are willing to > > sacrifice stability and security. The problem is that the strings that > > netfilter will see are broken down into smaller pieces. So the string > > "iptables and netfilter" might actually be transmitted as "iptables and= " > > and then "netfilter" in a separate packet. On top of this, people might > > try to intentionally break your filters by fragmenting the above string > > into "i", "p", "t", ... etc packets. > > > > The good thing to do in this case, is to wait until the TCP stream has > > reached the application layer and has been reassembled properly. Hence, > > you will want to either write your own proxy, or to use someone elses > > proxy. > > > > If you want to use it, I just uploaded a tunnel/proxy program to > > http://www.frozentux.net/stunnel.tgz. This is an unfinished program I > > started on a couple of years ago. It is written in C. It is horribly > > coded and pretty much sucks, but it has no memory leaks and might serve > > as a starting point. >=20 > Great!!! Really thanks but I just can't reach your program - above addres= s=20 > doesn't work :( Could you please do something or send the program on my=20 > private mail. >=20 Sorry about that, I got an urgent task on my desk and forgot to upload the file:). It's uploaded now. Do note that this is just a very ugly framework really, you need to do all the parsing etc on your own, and I have a bad habit of not commenting work in progress projects... =3D) > Thanks once again, > Marcin >=20 > > > > Have a nice day;). > > > > On Thu, 2005-10-27 at 11:40 +0200, Marcin Giedz wrote: > > > Dnia czwartek, 27 pa=C5=BAdziernika 2005 11:09, Ruprecht Helms napisa= =C5=82: > > > > Marcin Giedz wrote: > > > > > I don't get it :( > > > > > How with tcpdump as tcpdump is only dump traffic tool - as I know= it > > > > > can't change anything or I'm wrong? > > > > > > > > You are right. As I know it only dump. > > > > What you need is a hexeditor or you are looking for a tool that do > > > > hexediting in the fly. > > > > > > Absolutely! > > > > > > > But that is offtopic in this list. > > > > > > But I really don't know where to start? Perhaps some did it earlier. > > > > > > Marcin > > > > > > > Regards, > > > > Ruprecht --=-PYIb63wQYb++o214s/hL Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQBDYK3yGadwPDPpB60RAphjAJ4h6jlvDyXm2Xv9wcA/Msx7o+fPVQCgqnAL 9+jiLdWRtuElhLSAyOn+YSY= =cp+0 -----END PGP SIGNATURE----- --=-PYIb63wQYb++o214s/hL-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcin Giedz Subject: Re: question Date: Thu, 27 Oct 2005 13:18:06 +0200 Message-ID: <200510271318.06937.marcin.giedz@eulerhermes.pl> References: <200510270955.20466.marcin.giedz@eulerhermes.pl> <200510271225.50084.marcin.giedz@eulerhermes.pl> <1130409459.8832.15.camel@laptop3> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1130409459.8832.15.camel@laptop3> Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: oan@frozentux.net Cc: netfilter@lists.netfilter.org > Sorry about that, I got an urgent task on my desk and forgot to upload > the file:). It's uploaded now. Do note that this is just a very ugly > framework really, you need to do all the parsing etc on your own, and I > have a bad habit of not commenting work in progress projects... =) Hmm.. still have the same problem - sorry :( I tried http://www.frozentux.net as well but it seems like some problems with PHP script :( BR, Marcin From mboxrd@z Thu Jan 1 00:00:00 1970 From: Oskar Andreasson Subject: Re: question Date: Thu, 27 Oct 2005 15:28:43 +0200 Message-ID: <1130419723.8832.37.camel@laptop3> References: <200510270955.20466.marcin.giedz@eulerhermes.pl> <200510271225.50084.marcin.giedz@eulerhermes.pl> <1130409459.8832.15.camel@laptop3> <200510271318.06937.marcin.giedz@eulerhermes.pl> Reply-To: oan@frozentux.net Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-2ovZ2xX1ccVMO4Hzv/cm" Return-path: In-Reply-To: <200510271318.06937.marcin.giedz@eulerhermes.pl> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org To: Marcin Giedz Cc: netfilter@lists.netfilter.org --=-2ovZ2xX1ccVMO4Hzv/cm Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Shit happens, but now it works again. the admin of my site decided to switch the dns records over to a temporary site while they are upgrading the machine. my local dns server cached the old records while you seem to have gotten to the new servers, and i didn't see it.=20 To make a long story short, it's fixed. Same place as previously mentioned... 3rd times the charm *crossing fingers* =3D) On Thu, 2005-10-27 at 13:18 +0200, Marcin Giedz wrote: > > Sorry about that, I got an urgent task on my desk and forgot to upload > > the file:). It's uploaded now. Do note that this is just a very ugly > > framework really, you need to do all the parsing etc on your own, and I > > have a bad habit of not commenting work in progress projects... =3D) > =09 > Hmm.. still have the same problem - sorry :( I tried http://www.frozentu= x.net=20 > as well but it seems like some problems with PHP script :( >=20 > BR, > Marcin --=-2ovZ2xX1ccVMO4Hzv/cm Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQBDYNYLGadwPDPpB60RAvEIAKCuYgmcf2mIHzp8HxVzKPlH+IRp9ACfSwM1 9W+9LDhYLJMQIXq6ttVjf9w= =9MkM -----END PGP SIGNATURE----- --=-2ovZ2xX1ccVMO4Hzv/cm-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Fabio S. Silva" Subject: question Date: Wed, 21 Jun 2006 09:14:08 -0300 Message-ID: <12ec50350606210514j630bc4b4vd1064cd3d1f978b9@mail.gmail.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org Hi all, i trying to find tools to test my firewall, i need to make some test like "Sustained TCP Connections" but i dont know tools to do it.. and... i need some tools to simulate an ddos to my firewall to see if its droping packets, etc.. anybody can help me ?? best regards.. Fabio S. Silva From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Sietse van Zanen" Subject: RE: question Date: Wed, 21 Jun 2006 14:23:14 +0200 Message-ID: <02BB8A4AC86C564C89C7F14CF98CE0C40127AB@knowledge.wizdom.nu> References: <12ec50350606210514j630bc4b4vd1064cd3d1f978b9@mail.gmail.com> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: "Fabio S. Silva" , netfilter@lists.netfilter.org Usually you would test your firewall with the applications you need to = use through it. That would be the only realistic test application wise. =20 For testing sustained tcp connections you can use a tool tike TTCP, = which can open the connection and test throughput of your firewall. http://www.pcausa.com/Utilities/pcattcp.htm =20 Foor DDOS simulations, you would need multiple pc's on your network and = a simulation tool: http://www.ssfnet.org/javadoc/SSF/App/DDoS/package-summary.html =20 -Sietse ________________________________ From: netfilter-bounces@lists.netfilter.org on behalf of Fabio S. Silva Sent: Wed 21-Jun-06 14:14 To: netfilter@lists.netfilter.org Subject: question Hi all, i trying to find tools to test my firewall, i need to make some test like "Sustained TCP Connections" but i dont know tools to do it.. and... i need some tools to simulate an ddos to my firewall to see if its droping packets, etc.. anybody can help me ?? best regards.. Fabio S. Silva From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Karim Reda Fakhir" Subject: Question Date: Mon, 28 Apr 2008 11:01:39 +0200 Message-ID: <818933700804280201h63ccf323gba1e889c87cc39b4@mail.gmail.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=8eCUX5XctLYqNE2eU8xrjWSWp+jJ7PqnctXLn6RygkI=; b=NA/tAH5nTnJsWe2Zaohi1GXR0wrrLnayTkDf5oB/8vCyM5puWneJH03248pSoYA7tIW74d8HyE1o8iK24F7V4E01yS/o6EsGfmk75Um51eFiAcP+RXJhqzkXZFy5vSqeTR8CXBzuQS22sqSrMc8HMhfFAKuHxilUrvbGIGvb65k= Content-Disposition: inline Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: netfilter@vger.kernel.org How can i do SNAT and DNAT in same time with iptables , i try to change Ip src and Ip dest . Best Regards. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Engelhardt Subject: Re: Question Date: Mon, 28 Apr 2008 12:11:28 +0200 (CEST) Message-ID: References: <818933700804280201h63ccf323gba1e889c87cc39b4@mail.gmail.com> Mime-Version: 1.0 Return-path: In-Reply-To: <818933700804280201h63ccf323gba1e889c87cc39b4@mail.gmail.com> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: TEXT/PLAIN; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Karim Reda Fakhir Cc: netfilter@vger.kernel.org On Monday 2008-04-28 11:01, Karim Reda Fakhir wrote: >How can i do SNAT and DNAT in same time with iptables , i try to >change Ip src and Ip dest . -t nat -A PREROUTING -j DNAT ... -t nat -A POSTROUTING -j SNAT ... no? From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Diego Lacerda" Subject: Re: Question Date: Mon, 28 Apr 2008 22:51:33 -0300 Message-ID: References: <818933700804280201h63ccf323gba1e889c87cc39b4@mail.gmail.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=L5FCUIk1JQaEfcOO5LslmP3pncSFTq6PAUfs674jpl4=; b=BfmReKLLVAyMfiUhyOiv3YFWx/477LxYjrLtiQv41N0FpcUll0Dkout2woZx6oJ3+xd6exqmbvtv4hiffwUvpKQANpk1Y+U78e9OiGfgAbKdsGOsaMKoGq4V2wP6sHxLCzIX35FkwZJKiCquJyAaoo7C5svdUhg20sGUsTdjiwU= In-Reply-To: Content-Disposition: inline Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: Jan Engelhardt Cc: Karim Reda Fakhir , netfilter@vger.kernel.org Yeah, It's possible, netfilter will change the packet as it passes through the chains (in the NAT table). Regards, Diego Lacerda. On Mon, Apr 28, 2008 at 7:11 AM, Jan Engelhardt wrote: > > > On Monday 2008-04-28 11:01, Karim Reda Fakhir wrote: > > >How can i do SNAT and DNAT in same time with iptables , i try to > >change Ip src and Ip dest . > > -t nat -A PREROUTING -j DNAT ... > -t nat -A POSTROUTING -j SNAT ... > no? > > > > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html >