Hello, Bas van Sisseren a écrit : > > When redirecting, the destination address is replaced by the first > ip-address on the receiving interface. As described in the iptables manpage. > If the packet originally was sent to the second ip-address (or third, > fourth, etc..), this patch doesn't change the destination ip. Is this patch in reaction to the recent thread "iptables not forwarding port 443" in the netfilter user list from someone who stumbled into this issue ? My thoughts : 1) The iptables manpage would need to be updated accordingly. 2) I wonder whether it is really useful. The purpose of REDIRECT is to make sure a packet is redirected to the local machine itself without the need to care about the machine's address (just as MASQUERADE). If you don't want to change the destination address or need finer control over it, I believe DNAT can be used instead. Can you provide a use case ? 3) Why restrict only to the addresses attached to the receiving interface ? Why not extend to any address attached to a host's interface, or even any local address (such as the whole 127.0.0.0/8 prefix) ? -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
