Timothy Meader wrote: > Basically, I need the responses to any traffic coming in on UDP port > 1514 (or, alternatively, to the destination IP x.29) to go back out > with a src address of x.29 instead of x.17 or x.18. Is there a method > using iptables that can handle this problem? Or barring that, can > anyone think of any other means to accomplish this task if iptables > can't handle this on its own? Below, I've included the current > iptables data rules that the two cluster nodes are presently sharing. You could try a source NAT rule, eg iptables -t nat -A POSTROUTING -p udp --sport 1514 -j SNAT --to-source xxx.xxx.xxx.29 but I'm not sure that this will work, since the tuple will clash with the connection that was created for the incoming packet. You can't use iptables to do policy routing based on port, since that happens after address selection. The proper fix is to change OSSEC to use the correct source address for its replies. I can think of two ways for this. First, OSSEC could bind() to a specific address instead of INADDR_ANY. I don't know if it already has a config option to do this. Second, OSSEC could use the IP_PKTINFO socket option to determine the address it received a packet on, and send its reply using this as the source address. For an example of an application that does this, see openswan (the code is in lib/libopenswan/udpfromto.c). - To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
