Pascal Hambourg wrote: > Hello, > > Philip Prindeville a écrit : >> >> iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 8080 -j DNAT >> --to-destination :80 >> >> but later in the INPUT chain, I'd like to be able to distinguish between >> a packet that came in directly to port 80 (which I'd reject) versus a >> packet that came in to a different port (like 8080 above) and was >> remapped... which I'd like to accept. > > May I ask why ? > >> Is there a test to available in INPUT (and FORWARD) see if the packet >> had been rewritten in the PREROUTING chain? > > You might try the '-m conntrack' match and its '--ctstate DNAT' option. > Not sure it works when only remapping the port, though. Otherwise you > can MARK packets in mangle/PREROUTING before they are remapped and > accept or drop them after. That worked like a charm. Thanks. -Philip -- To unsubscribe from this list: send the line "unsubscribe linux-net" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
