Re: DCERPC - does an add-on exist for netfilter

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 30.01.2011 12:07, Jim Webster wrote:
> Hi.  I am new to the list and also fairly new to iptables and
> netfilter.  Linux and programming - am familiar with.
> Have been tasked to provide a way to move MSMQ (DCERPC?) traffic thru
> our firewall.
> The firewall is a CentOS iptables based box.
> 
> Unfortunately, I do not zet have the customer Wireshark trace showing
> the traffic, specificallz where the  address (and port) is supposedlz
> sent in the pazload.
> 
> A knowledgeable iptables/firewall person on our team has suggested we
> require a netfilter helper routine (ala the ftp connection tracking).
> 
> It seems to me however that instead, some tzpe of adaptive firewall
> technique is required to do this - opening a new NAT for the IP/port
> sent in the pazload and closing it when done.
> 
> If so, can this be done by a simple user app - perhaps a proxy, or
> should it be in the loadable kernel modules as the ftp connection
> tracker is?

Yes, you'll need a connection tracking helper that is able to
parse the DCERPC traffic in order to integrate this with netfilter
and NAT. I've looked into this a while ago, but due to the
complexity of the protocol it is non trivial.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux