Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working on an iptables rule to apply after my shorewall script has initialized the firewall. I want a specific IP address (10.0.1.19) in my lan to be redirected to 10.0.64.1 unless it is going to paypal.

I have the following rule, and that works like a charm:

iptables -t nat -A PREROUTING ! -d 1.2.3.4 -s 10.0.1.19 -j DNAT --to 10.0.64.1

My problem is that paypal uses multiple ip addresses and I am not allowed to have multiple IP-addresses.

https://ppmts.custhelp.com/cgi-bin/ppdts.cfg/php/enduser/std_adp.php?p_faqid=92

On top of this problem I would like to know how to remove the rule again, without having to restart shorewall.

Kind regards

Tax

share|improve this question
    
This is more of a ServerFault question than a stackoverflow one. However you can delete rules from iptables with "iptables -t nat -D rulenumber" and there are iptables modules that allow you to match multiple IP addresses. If you don't have such a module you'll have to add several rules. Anyway you can find all answers in iptables excelent documentation. –  Miguel Ventura Oct 27 '09 at 19:04
add comment

migrated from stackoverflow.com Oct 27 '09 at 19:23

This question came from our site for professional and enthusiast programmers.

4 Answers

Either way:

1) Schematically (not gonna check the syntax, so do your math):

iptables -t nat -A PREROUTING -s 10.0.1.19 -j REDIRECT? -m comment --comment "should it be redirected?"

iptables -t nat -A REDIRECT? -d DST_IP1 -j RETURN -m comment --comment "nope"

iptables -t nat -A REDIRECT? -d DST_IP2 -j RETURN -m comment --comment "nope"

iptables -t nat -A REDIRECT? -d DST_IPn -j RETURN -m comment --comment "nope"

iptables -t nat -A REDIRECT? -j DNAT --to 10.0.64.1 -m comment --comment "yep"

2) google up ipset

share|improve this answer
add comment

I did some research and want to post the results.

I also found out I could do like so:

iptables -t nat -A PREROUTING -d 1.2.3.4 -j ACCEPT
iptables -t nat -A PREROUTING -d 6.7.8.9 -j ACCEPT
iptables -t nat -A PREROUTING ! -d 10.0.64.1 -s 10.0.1.19 -j DNAT --to 10.0.64.1

I can list the rules with:

iptables -t nat --line-numbers -n -L  PREROUTING

I can delete rules by:

iptables -t nat -D PREROUTING RULENUMBER

Hope somebody finds this usefull :)

share|improve this answer
    
Is it not possible to specify the domain name you would want for Paypal? I know iptables works in some cases for this (iptables -A OUTPUT -p tcp --dport 80 -d facebook.com -j DROP), so I'd imagine it works for other destination values as well. –  Paul Kroon Jun 3 '10 at 0:54
add comment

You probably want to use an HTTP proxy for this, not a firewall. A proxy can understand http, can see that the paypal domain is being requested, and can take appropriate action. For instance, privoxy is often used to change requests for images from advertising sites. You can chain different http proxies together, to combine the strengths of different kinds, or to make a "flowchart" of different reactions depending on request type.

share|improve this answer
    
+1. use the right tool for the job, it'll save a lot of headaches down the line when you find a website that uses ips that aren't in clear blocks, or every time paypal adds an IP your firewall breaks. –  Sirex Sep 22 '11 at 7:52
add comment

I think you might be able to use the iprange module for something like this, I have used it for generic firewall rules before:

iptables -I RH-Firewall-1-INPUT 11 -m iprange --src-range 192.168.254.1-192.168.254.254 -d 172.16.1.207 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

Edit:
Errr... I take it back, I think you might want the --to-source or --to-destination with NAT,. You just put the range with a hypen, ie: --to-source 192.168.1.1-192.168.1.254 . See the DNAT and SNAT sections of the iptables man page.

share|improve this answer
    
Don't know about shorewall though, sorry. –  Kyle Brandt Oct 27 '09 at 19:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.