NetFilter
[Top] [All Lists]

Re: iptables NEW TABLE request. WAS[Re: Catching un-DNAT'ed packets]

To: Jan Engelhardt <jengelh@linux01.gwdg.de>
Subject: Re: iptables NEW TABLE request. WAS[Re: Catching un-DNAT'ed packets]
From: Покотиленко Костик <casper@meteor.dp.ua>
Date: Fri, 26 Jan 2007 18:27:09 +0200
Cc: netfilter@lists.netfilter.org, Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
In-reply-to: <Pine.LNX.4.61.0701261707190.22295@yvahk01.tjqt.qr>
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Organization: СК "Метеор"
References: <1167054030.16171.10.camel@localhost.localdomain> <459102EC.50402@plouf.fr.eu.org> <1169810473.8286.8.camel@localhost.localdomain> <Pine.LNX.4.61.0701261223430.22295@yvahk01.tjqt.qr> <1169814795.5004.11.camel@localhost.localdomain> <Pine.LNX.4.61.0701261707190.22295@yvahk01.tjqt.qr>
Reply-to: casper@meteor.dp.ua
Sender: netfilter-bounces@lists.netfilter.org
В Птн, 26/01/2007 в 17:12 +0100, Jan Engelhardt пишет:
> >В Птн, 26/01/2007 в 12:24 +0100, Jan Engelhardt пишет:
> >> >http://www.meteor.dp.ua/casper/firewill.pdf
> >> >
> >> >how would I make a "feature request" to ask for, say, "mangle2" table
> >> >that is just after "nat" in POSTROUTING? The only reason for this move
> >> >is the need for ability to catch un-DNAT'ed packets with -j ULOG or
> >> >(better) to -j QUEUE.
> >> 
> >> And  -t nat -A POSTROUTING -m conntrack ! --ctstate DNAT
> >> as a last rule won't do?
> >
> >This will (probably) catch packets that hasn't been DNAT'ed.
> >BUT, the thing I need it to catch replay packets that has already passed
> >"un-DNAT" procedure.
> 
> Ah, now I get what you mean with un-DNAT. (Unwrapping I'd say ;-)
> Too bad, I don't see a way. But as an intermediate workaround, you could
> copy ULOG/QUEUE to a new module, say, MYULOG/MYQUEUE and modify it so as to
> display the original address pair (which should easily be possible with kernel
> code).

That requires kernel hacking practice which I don't have. Also I won't
do that, because this is for *production use*, so I would relay on
someone experienced.

Also, considering that the need I have is not so specific and it is
highly probable that it will be usefull for many others I would rather
prefer to make a "feature request" for that extra table (ala "mangle2")
to be implemented by professional team of kernel developers.

And, is it possible to get a verdict about this request here? Or maybe
there is more suitable place to ask?

Thanks for quick answer.
-- 
Покотиленко Костик <casper@meteor.dp.ua>



<Prev in Thread] Current Thread [Next in Thread>