0

I have a certain packet that I want at all times to be redirected to a specific ip on my virtual network interface. As for now my iptables is setup like this:

(the commands, I use \ as for now to make it more readable, read as "combine next line to this line" :) ) For allowed IP's:

iptables \
-t nat -A PREROUTING \
-i vmbr0 -p udp --dport 7777 \
-m set --match-set whitelist \
-j DNAT --to 192.168.0.1:7777

For disallowed IP's:

iptables \
-t nat -A PREROUTING \
-i vmbr0 -p udp --dport 7777 \
-m set ! --match-set whitelist \
-j DNAT --to 192.168.0.1:7778

But there is a certain udp packet (that matches some hex, preferably with wildcards if possible) that I want to pass to 192.168.0.1:7777 regardless of the whitelist entry, how would I do that?

So eventually this would be the result:

enter image description here

2

Got me! :-) I was wrong. What I thought about (the -m string match extension) is not possible, we are in the nat table and only first packet of the "connection" (even if udp) will pass through this table. So we cannot check all packets of same connection and deviate just one.

You could check the match extension string (-m string).

Note also that the DNAT target is terminating, meaning that if the packet matches a rule with a DNAT target, the packet will not go through the rules that follow.

So you could go for this kind of solution:

In your nat table:

First rule: the first rule you mention, which matches the whitelist

The pakets still flowing through after this rule are the packets that do not match the white list (more precisely the UDP packets for port 7777 that do not match the whitelist).

Second rule: Here you can use -m string. Beware it can be resource intensive to check strings in packets. You can match against hex strings (--hex-string option), but I do not know about wildcards in this match extension.

Third rule: could be simplified, because of terminating target DNAT

Hope this helps.

  • what are the commands I could use? I'm merely a end user, not a linux expert :X – Gizmo Nov 20 '14 at 14:45
0

To match string in [acket content You can use

"--string [!] string"

if it compiled in Your kernel.

But there no wildchar and I don't found way to use hex.

  • I dont think the packet i want to redirect can Be expressed in a string... – Gizmo Nov 20 '14 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.