Groups > comp.os.linux.networking > #973

iptable rule for bypassing netfilter queue for a matching address.

Path	csiph.com!x330-a1.tempe.blueboxinc.net!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!npeer03.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!postnews.google.com!glegroupsg2000goo.googlegroups.com!not-for-mail
From	ArifulHossain tuhin <etothepowerpi@gmail.com>
Newsgroups	comp.os.linux.networking
Subject	iptable rule for bypassing netfilter queue for a matching address.
Date	Sat, 14 Jan 2012 03:28:45 -0800 (PST)
Organization	http://groups.google.com
Lines	27
Message-ID	<2624554.987.1326540525435.JavaMail.geo-discussion-forums@prok2> (permalink)
Reply-To	comp.os.linux.networking@googlegroups.com
NNTP-Posting-Host	120.50.181.131
Mime-Version	1.0
Content-Type	text/plain; charset=ISO-8859-1
Content-Transfer-Encoding	quoted-printable
X-Trace	posting.google.com 1326540526 953 127.0.0.1 (14 Jan 2012 11:28:46 GMT)
X-Complaints-To	groups-abuse@google.com
NNTP-Posting-Date	Sat, 14 Jan 2012 11:28:46 +0000 (UTC)
Complaints-To	groups-abuse@google.com
Injection-Info	glegroupsg2000goo.googlegroups.com; posting-host=120.50.181.131; posting-account=4zrMCQoAAADYCFHhx5VIUZOBVb_g8iSO
User-Agent	G2/1.0
X-Google-Web-Client	true
Xref	x330-a1.tempe.blueboxinc.net comp.os.linux.networking:973

Show key headers only | View raw

I have two iptable rules for userspace modification :

iptable -t mangle -A PREROUTING -p udp --dport 9090 -j NFQUEUE
iptable -t mangle -A OUTPUT -p udp --sport 9090 -j NFQUEUE

I have the following network setup:

client ---------------->Linux Box or router--------------------->server. What i'm trying to achieve is modifying all packets which comes from client to 9090 port of the Linux Box. Also which packets will go from Linux Box to client. I do not want to manipulate both from or to the server.

So the rules i need will work like this:

If packet comes from client to port 9090 i will modify it. Now the router opens symmetric port when it communicates with the server. That means it opens 9090 port when it communicates with the server and hence get modified by the second rule(--sport 9090). I want to avoid this. 

The rules will be like this:

1.If packet comes from a specific ip block i will accept it. then i will queue the remaining packets based on the destination port it comes to. 
2.If packet goes to a specific ip block i will forward it. I will queue the remaining packets based on the source port information.

Thanks in advance.

Back to comp.os.linux.networking | Previous | Next | Find similar | Unroll thread

Thread

iptable rule for bypassing netfilter queue for a matching address. ArifulHossain tuhin <etothepowerpi@gmail.com> - 2012-01-14 03:28 -0800

csiph-web