NetFilter
[Top] [All Lists]

Re: iptables NEW TABLE request. WAS[Re: Catching un-DNAT'ed packets]

To: Jan Engelhardt <jengelh@linux01.gwdg.de>
Subject: Re: iptables NEW TABLE request. WAS[Re: Catching un-DNAT'ed packets]
From: Покотиленко Костик <casper@meteor.dp.ua>
Date: Wed, 31 Jan 2007 11:14:48 +0200
Cc: netfilter@lists.netfilter.org
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
In-reply-to: <Pine.LNX.4.61.0701301901470.13737@yvahk01.tjqt.qr>
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Organization: СК "Метеор"
References: <1167054030.16171.10.camel@localhost.localdomain> <459102EC.50402@plouf.fr.eu.org> <1169810473.8286.8.camel@localhost.localdomain> <1170086305.11285.4.camel@localhost.localdomain> <Pine.LNX.4.61.0701301145530.23321@yvahk01.tjqt.qr> <Pine.LNX.4.61.0701301901470.13737@yvahk01.tjqt.qr>
Reply-to: casper@meteor.dp.ua
Sender: netfilter-bounces@lists.netfilter.org
В Вто, 30/01/2007 в 19:02 +0100, Jan Engelhardt пишет:
> On Jan 30 2007 11:46, Jan Engelhardt wrote:
> >>Excuse me for double asking, but is this the place for such a feature
> >>request?
> >
> >At least it's not the wrong place.
> 
> For the mailinglist record, the solutions is:
> 
>   -t nat -A POSTROUTING -m conntrack --ctstate DNAT --ctorigdst x.x.x.x

Just to make sure. This rule will match the packets with canntrack state
"DNAT" and whose original (before DNAT) destination address was x.x.x.x,
right?

If I add -j ULOG to this rule what would be logged packet source address
for replay packet (Server->Client)? Original, that client was initially
connected to, or real, that was set during DNAT? 

By the way does -m conntrack --ctstate DNAT --ctorigdst x.x.x.x match
request or replay packets or packets belonging to connection which was
originally made to x.x.x.x?

-- 
Покотиленко Костик <casper@meteor.dp.ua>



<Prev in Thread] Current Thread [Next in Thread>