Re: Matching DNAT'd packets

[Philip A. Prindeville]

Pascal Hambourg wrote:
> Hello,
> 
> Philip Prindeville a écrit :
>>
>> iptables -t nat -A PREROUTING -i $EXTIF -p tcp --dport 8080 -j DNAT
>> --to-destination :80
>>
>> but later in the INPUT chain, I'd like to be able to distinguish between
>> a packet that came in directly to port 80 (which I'd reject) versus a
>> packet that came in to a different port (like 8080 above) and was
>> remapped... which I'd like to accept.
> 
> May I ask why ?
> 
>> Is there a test to available in INPUT (and FORWARD) see if the packet
>> had been rewritten in the PREROUTING chain?
> 
> You might try the '-m conntrack' match and its '--ctstate DNAT' option.
> Not sure it works when only remapping the port, though. Otherwise you
> can MARK packets in mangle/PREROUTING before they are remapped and
> accept or drop them after.

That worked like a charm.  Thanks.

-Philip

--
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html