Pascal Hambourg a écrit :
Good day,
Daniel Huhardeaux a écrit :
I would like to redirect an external port to another port on the same
machine.
REDIRECT is your friend.
Thanks to Mart and you I got it work :-)
I read on some documents that the kernel doesn't allow DNAT to
127.0.0.1 so I ended up with following setup:
This is not exactly right. NAT allows any address you like, but the
kernel routing prohibits packets with an address in the loopback range
on a non-loopback interface, regardless of NAT. It might be worth
mentionning that the routing decision occurs after the PREROUTING chain
and does not know about the original destination address. However DNAT
to 127.x.y.z works fine in the OUTPUT chain because the packets are
rerouted through the loopback interface and don't leave the host.
My rules are:
[snip]
[ -z $IP ] &&
IP=$EXTERNAL_MAIN_IP
[ -z $PORT ] &&
PORT=$EXT_PORT
$IPTABLES -t mangle -A PREROUTING -p tcp -i
$EXTERNAL_MAIN_DEVICE -d $EXTERNAL_MAIN_NET --dport $PORT -j
DROP
if [ "$IP" == "$EXTERNAL_MAIN_IP" ]; then
$IPTABLES -t nat -A PREROUTING -p tcp -i
$EXTERNAL_MAIN_DEVICE -d $IP --dport $EXT_PORT -j
REDIRECT --to-port $PORT
$IPTABLES -A INPUT -p tcp -i
$EXTERNAL_MAIN_DEVICE -d $IP --dport $PORT -j
ACCEPT
else
# To inhibed when IP is 127.0.0.1
$IPTABLES -t nat -A PREROUTING -p tcp -i
$EXTERNAL_MAIN_DEVICE -d $EXTERNAL_MAIN_NET --dport $EXT_PORT -j
DNAT --to $IP:$PORT
$IPTABLES -A FORWARD -p tcp -m
tcp --dport $PORT -j
ACCEPT
# Test for redirection to localhost, to activate when IP
is 127.0.0.1
#$IPTABLES -t nat -A OUTPUT -p tcp -o
$EXTERNAL_MAIN_DEVICE -d $IP --dport $EXT_PORT -j
DNAT --to $IP:$PORT
#$IPTABLES -A [INPUT|FORWARD] -p tcp -m
tcp --dport $PORT -j
ACCEPT
fi
This is working fine when $IP is the public one or the Intranet one. But
when I put the localhost 127.0.0.1 and activate the right stuff, it's
not working (tried with both INPUT and FORWARD). Telnet to the EXT_PORT
shows try to connect ... From the host, telnet localhost $PORT is working.
Concerning mark of packets, as I told in my original mail, they are
already marked in the mangle table, prerouting rule for my 2 ISP. I
tried to find a solution with save/restore but problem is that mangle
can't use user define target, so how to restore original mark AND accept
the packet?
Thanks to you and Mart for your time
--
Daniel Huhardeaux _____ ____ ____ _____ _____ _
enum +33 368 460 088 (_ __) _ ) _ (_ __) _ _(_) +48 222 472 472
iaxtel 1-700-849-6983 / / / // / // / / / / /_/ / / GIZMO,SKYPE,GTALK
sip/iax:callto 101@sip./_/ ( ___( ___/ /_/ (_/ (_/_/.net tootaiNET
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
