Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2077

Re: iptables string match

Show all headers | View raw

On Mon, 01 Apr 2013 22:36:12 +0000, buck wrote:

>> Yes and no. What do you want to achieve? If it is not the first packet
>> of a "connection", DNATting proabably does not do what you want.
>> 
> 
> This may sound foolish, but there is very good reason for it.
> 
> I run IBM OmniFInd, which is the same crawler engine as Yahoo! uses to
> index web pages.  I need to serve a substitute robots.txt when OmniFind
> asks a remote host for its robots.txt.  The reason is that this is the
> fastest and most reliable way to purge from OmniFind those links that
> are 404 or 410 (not found / gone).
> 
> I have no control over when OmniFind requests robots.txt from that
> particular remote host, so debugging is difficult.
> 
> What I've done is to set up a small web server on my gateway box that
> listens on port 1080 and serves only robots.txt (containing 559 bad
> links right now).  I hope that something like
> 
> iptables -t mangle -I PREROUTING -p tcp -m string --string robots.txt \
>   -j MARK --set-mark 0x2
> iptables -t nat -I OUTPUT -p tcp -m mark --mark 0x2 -j REDIRECT \
>   --to-ports 1080
> 
> will cause the marked packets to be sent to my web server.  And
> accomplish the objective...
> 
> Note that the iptables "mangle" line above has been edited in hopes that
> removing a bunch of "stuff" will improve clarity with respect to what
> I'm trying to accomplish.

This will never work. You cannot DNAT a connection that is already set up.

Alternatives:
0) The above will (try to) redirect all requests for robots.txt, why not 
just replace it on the target webserver?
1) If OmniFind has a fixed IP, DNAT that (but that will redirect all 
requests, not just robots.txt)
2) Put a transparant proxy on the gateway that redirects requests 
robots.txt to your webserver and all other requests to the target 
webserver

Other stuff that may give you building blocks for a solution:
- Does OmniFind have a unique agent identifier?
- Target webserver is Apache? Many moduless can customize what is 
returned.

HTH,
M4

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

iptables string match buck <buck@private.mil> - 2013-04-01 19:49 +0000
  Re: iptables string match Martijn Lievaart <m@rtij.nl.invlalid> - 2013-04-01 23:50 +0200
    Re: iptables string match buck <buck@private.mil> - 2013-04-01 22:36 +0000
      Re: iptables string match Martijn Lievaart <m@rtij.nl.invlalid> - 2013-04-02 19:52 +0200

csiph-web