RE: Single IP

RE: Single IP

[Pmishra]

That's My question,
I want to use some Option or flag  in socket label so that we can identify
the socket in server site and forward as per this option.


I saw some link
<http://www.gsp.com/cgi-bin/man.cgi?section=2&topic=getsockopt> (see
SO_ACCEPTFILTER ) , but I don't identity exactly about setsocketopt and
getsocketopt.

Please help me for solve the problem.
Thanks
Pradeep


-----Original Message-----
From: Michael Tautschnig [mailto:michael.tautschnig@zt-consulting.com]
Sent: Thursday, March 03, 2005 7:13 PM
To: Pmishra@in.safenet-inc.com
Cc: netfilter@lists.netfilter.org
Subject: Re: (no subject)


> Hi Team,
> My requirement is Use SingleIP and different port with different web based
> application .
> Requirement :-
> 1.Access all the request from client with PORT 80.
> 2.Check the socket filter or net filet and forward different port as per
> hint send by client.
> Is it possible in Linux ?

Well, what is the "hint", sent by the client?

Thanks,
Michael

RE: Single IP

[Michael Tautschnig]

> That's My question,
> I want to use some Option or flag  in socket label so that we can identify
> the socket in server site and forward as per this option.
>
>
> I saw some link
> <http://www.gsp.com/cgi-bin/man.cgi?section=2&topic=getsockopt> (see
> SO_ACCEPTFILTER ) , but I don't identity exactly about setsocketopt and
> getsocketopt.
>
IMHO this is just for local operation on a socket, this has nothing what 
so ever to do with the packets!

Could you please tell as a bit more, what kind of "services" you are 
trying to establish. If it were http-based services, you could always use 
the host-field of the packet - but this has to be done at application 
level, it's not (really) a job of iptables. Actually, there is a 
layer7-filter-project for iptables, but - we just don't know what you are 
trying to do ...

Could you please answer the following questions?

- What is the client using to access your services? A web-browser?
- What "services" are you providing? Websites?
- You can't have more than one application listening on port 80, so how 
are you dealing with that issue?
- why do you stick to 1 IP and 1 port?

Thanks,
Michael

RE: Single IP

[Pmishra]

Please see my answer below.

- What is the client using to access your services? A web-browser?
I Open the the portal page and click on the some link then my own service
start and listen the server.
- What "services" are you providing? Websites?
I have two application name is VPX and FNC.
- You can't have more than one application listening on port 80, so how are
you dealing with that issue?
My requirement is OPEN ONE tunnel( between server and client) and all the
data will send via this tunnel. and In server side I check the packet and
forward To appropriate server as per FLAG. 
- why do you stick to 1 IP and 1 port?
Because If client use some firewall the may be he open only single port for
communicate with server.

Thanks
Pradeep


-----Original Message-----
From: Michael Tautschnig [mailto:michael.tautschnig@zt-consulting.com]
Sent: Friday, March 04, 2005 3:10 PM
To: Pmishra@in.safenet-inc.com
Cc: netfilter@lists.netfilter.org
Subject: RE: Single IP



> That's My question,
> I want to use some Option or flag  in socket label so that we can identify
> the socket in server site and forward as per this option.
>
>
> I saw some link
> <http://www.gsp.com/cgi-bin/man.cgi?section=2&topic=getsockopt> (see
> SO_ACCEPTFILTER ) , but I don't identity exactly about setsocketopt and
> getsocketopt.
>
IMHO this is just for local operation on a socket, this has nothing what 
so ever to do with the packets!

Could you please tell as a bit more, what kind of "services" you are 
trying to establish. If it were http-based services, you could always use 
the host-field of the packet - but this has to be done at application 
level, it's not (really) a job of iptables. Actually, there is a 
layer7-filter-project for iptables, but - we just don't know what you are 
trying to do ...

Could you please answer the following questions?

- What is the client using to access your services? A web-browser?
- What "services" are you providing? Websites?
- You can't have more than one application listening on port 80, so how 
are you dealing with that issue?
- why do you stick to 1 IP and 1 port?

Thanks,
Michael

RE: Single IP

[Michael Tautschnig]

>
> - What is the client using to access your services? A web-browser?
> I Open the the portal page and click on the some link then my own service
> start and listen the server.
> - What "services" are you providing? Websites?
> I have two application name is VPX and FNC.
> - You can't have more than one application listening on port 80, so how are
> you dealing with that issue?
> My requirement is OPEN ONE tunnel( between server and client) and all the
> data will send via this tunnel. and In server side I check the packet and
> forward To appropriate server as per FLAG.

So I assume, these packets are not http-requests anymore. If you're able 
to control the packets sent by the client, you could, e.g., abuse the 
DSCP-field of the IP header. By setting it to some specific value, you 
might be able to match it at your site and then, using the 
REDIRECT-target, you could send the packets where you want.

If you are unable to control the packets sent by the client, you should 
finally tell us what this is all about, i.e., you need to explain the 
whole handshake.

Regards,
Michael