Messages in this thread | | | Date | Tue, 5 Jan 1999 17:34:36 -0600 | From | "Major'Trips'" <> | Subject | Re: IP Firewalling/Redirect |
| |
On Wed, Jan 06, 1999 at 09:53:20AM +1100, John Newnham wrote: > In article <19990103234550.A3743@jimco-fwt.com> you write: > > On Sun, Jan 03, 1999 at 05:50:38AM -0600, Major'Trips' wrote: > > > Problems came when I tried to ping/telnet ..ect.. ( use anything > > > other then nslookup ). The request would hang and I would get back > > > something to the aspect of "host not found" after a timeout period. > ... > > Thusly I would reccomend that apon handling a redirection on > > the input I would think the output of that port would need to > > be translated in some way to perform a trully transparent > > feature. > > UDP is a datagram protocol. It does not form a virtual circuit. > > TCP is a connected protocol. It _does_ form a circuit, as soon as > the connection is made. The circuit carries data in both directions. > > You have redirected the UDP traffic flowing in one direction. > You have _not_ redirected the UDP traffic flowing in the other > direction. > > Things are working exactly as they are designed to work. > > bfn, > > ashtray
ipfwadm man page: -r [port] Redirect packets to a local socket. When this option is set, packets accepted by this rule will be redirected to a local socket, even if they were sent to a remote host. If the specified redirec- tion port is 0, which is the default value, the destination port of a packet will be used as the redirection port. This option is only valid in input firewall rules with policy accept and can only be used when the Linux kernel is compiled with CONFIG_IP_TRANSPARENT_PROXY defined.
ipchains manpage: REDIRECT is only legal for the input and user-defined chains and can only be used when the Linux kernel is com- piled with CONFIG_IP_TRANSPARENT_PROXY defined. With this, packets will be redirected to a local socket, even if they were sent to a remote host. If the specified redirection port is 0, which is the default value, the destination port of a packet will be used as the redirec- tion port. When this target is used, an optional extra argument (the port number) can be supplied.
Both man pages show that the redirect rule is only legal for the input rule. It is possible to do a redirection on the oubound .. but that seems to entail spawning a user land application that utilizes the MSG_PROXY on the socket itself. In short, bind to the socket and handle redirection from user land.
If UDP Redirection via the kernel firewalling rules cannot be handled then why is it an option?
-- "Reality is what you can get away with!" ++Robert Anton Wilson Major'Trips' E-Mail : shadow@cyberwizards.com || major@jimco-fwt.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |