Rob Sterenborg wrote:
Is there a way to define a condition "those packets whose destination
is the IP address of the given interface" without specifying the
actual IP address? (it changes, thus needs to be detected and updated)
No. -d expects an IP address.
I was looking for a (non-existent) option like
--dest-ip-address-matches-that-of eth1. Meaning the connection is
addressed to the box, as opposed to passing through it to some other
machine but to the same port.
The problem with specifying an IP is that it may change, which breaks
the rules and requires an update (and detection as well). Event for a
static IP, that's an extra dependency to watch out for.
What is it exactly what you want to accomplish?
Maybe this is contrived and not a good method..
I want the above-described kind of option, to pick out and DNAT
connections on a certain port (say, http) directed at the box, but not
those on the same port but directed elsewhere (like google being
accessed through the box being the gateway). Purpose - to
DNAT-encapsulate some service by the box.
(It doesn't matter from which direction it came, on which interface, its
contents, etc. - only the destination ip.)
If i say "-d <ip.of.the.box> --dport 80 -j DNAT ..", that works, but it
introduces the unwanted dependency on the actual IP value.
If i say "-i <interface> --dport 80..." for an internal interface, that
catches anything, whether it was meant for the box or google.
Thanks,
--Dmitri
