On Mon, 2007-12-17 at 15:41 +0100, Gwenhaël Pasquiers wrote:
> Hi,
>
> I'm facing an issue while trying to make a captive protal using iptables.
>
> marked packets in mangle PREROUTING should be normally forwarded.
> unmarked packets in mangle should be dropped or DNATed to my http portal.
>
> I'm using DNAT + SNAT on unmarked packets to redirect to my portal.
>
> I'm forwarding marked packets with SNAT.
>
> The problem is that the NAT connection stays active even if the
> packets of this connection are marked and do not .
Are you sure that the connection is still being NAT'ed and it is not TCP
Keepalives?
So you have something like this:
# dont DNAT anything that is authenticated
iptables --table nat --append PREROUTING \
--in-interface ${incoming_traffic_interface} \
--match mark --mark ${allow_passage_integer} --jump ACCEPT
# dont DROP (via a rule in the filter table) anything that is
# authenticated
iptables --table filter --append FORWARD \
--in-interface ${incoming_traffic_interface} \
--match mark --mark ${allow_passage_integer} --jump ACCEPT
iptables --table nat --append PREROUTING \
--in-interface ${incoming_traffic_interface} \
--protocol tcp --destination-port 80 \
--jump DNAT --to-destination ${ip_address}
iptables --table nat --append PREROUTING \
--in-interface ${incoming_traffic_interface} \
--protocol tcp --destination-port 443 \
--jump DNAT --to-destination ${ip_address}
> In that case, when refreshing the page, the browser use the same TCP
> connection that is still DNATed to my captive portal. I'd like it not
> to be forwarded anymore.
I had issues with tcp keepalives. I had to tweak the apache configs:
KeepAlive Off
[...]
HTH,
--
Matt Zagrabelny - mzagrabe@xxxxxxxxx - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 1024D/84E22DA2 2005-11-07
Fingerprint: 78F9 18B3 EF58 56F5 FC85 C5CA 53E7 887F 84E2 2DA2
He is not a fool who gives up what he cannot keep to gain what he cannot
lose.
-Jim Elliot
Attachment:
signature.asc
Description: This is a digitally signed message part
