Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an application (mirth) on a server (10.2.2.200) that on port 6661 is receiving an HL7 feed from an egate server from 10.0.1.234 port 56789. For each message it receives/processes, its generating back an HL7 ACK message to 10.0.1.234 port 56789. The egate server (which I don't control) isn't getting the ACK messages though, as its expecting to receive them at 10.1.1.111 port 6661.

Would it be possible to setup iptables (on my mirth server -- that is 10.0.2.200) to edit the ACK packets generated by mirth that were originally supposed to go to 10.0.1.234 port 56789 and instead send them to 10.1.1.111 port 6661?

I'm reading up on NAT/iptables ( http://www.karlrupp.net/en/computer/nat_tutorial ), but I'm not sure if its possible at this point and any help would be much appreciated.

Summary of fake IPs:

  • Mirth : 10.2.2.200 (listening to port 6661)
  • Egate sender: 10.0.1.234 (listening to port 56789)
  • Egate wants listening for ACKs: 10.1.1.111 port 6661
share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

You can use iptables with the --tcp-flags argument:

--tcp-flags [!] mask comp

Match when the TCP flags are as specified. The first argument is the flags which we should examine, written as a comma-separated list, and the second argument is a comma-separated list of flags which must be set. Flags are: SYN ACK FIN RST URG PSH ALL NONE. Hence the command

  iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN

will only match packets with the SYN flag set, and the ACK, FIN and RST flags unset.

I don't have a linux box handy to gin up the right incantation, but I'd think it would go something like:

iptables -t nat -A PREROUTING -p tcp --tcp-flags ACK ACK --dest 10.0.1.234 --dport 56789 -j DNAT --to:destination 10.1.1.111:6661
share|improve this answer
add comment

More or less your wanting to take advantage of the packet mangling feature of iptables. It involves altering the packets in the prerouting and postrouting tables. You also need to load a custom module when using this feature. I am in no way a pro at iptables, but have dealt with this in the past when I was alot younger. Heres a link to a document describing the process -

There is more on google about mangling packets. Sorry for not being more informative. I hope this help with conquest to take over the world.

www.linuxsecurity.com.br/info/fw/PacketManglingwithiptables.doc

share|improve this answer
add comment

I think this will work (though its not just filtering just ACKs and I am still testing.)

iptables -t nat -A OUTPUT -p tcp -d 10.0.1.234 --dport 10000:65535 -j DNAT --to-destination 10.1.1.111:6661
share|improve this answer
2  
I don't believe you CAN filter just the (HL7) ACK (message) with iptables -- IPTables doesn't know the content. This solution redirects all the traffic which may break stuff. You'd really need something sitting in the middle that is HL7-aware to handle the message routing... –  voretaq7 Aug 18 '11 at 21:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.