Re: IP Firewalling/Redirect

Major'Trips' (major@jimco-fwt.com)
Mon, 4 Jan 1999 01:46:12 -0600


On Sun, Jan 03, 1999 at 05:50:38AM -0600, Major'Trips' wrote:
> This I assumed would redirect any requests from the local network
> to port 54 to be handled by the second named. This failed misserably.
> It turns out that the redirection does not function if the initial
> destination port ( port 53 ) is bound to.
> ( so far only true for named for unknown reasons )

I "think" ( smoke again ) that the reason it is true for named
so far is that it appears to only be a real problem on the
UDP side.

Experiment:
ipchains rules:
ipchains -F
ipchains -A input -p 6 -s 0/0 -d 192.168.1.42 6666 -j REDIRECT 6667 -l
ipchains -A input -p 17 -s 0/0 -d 192.168.1.42 6666 -j REDIRECT 6667 -l

netcat:
nc -l -p 6666 # on vc1
nc -l -p 6667 # on vc2
nc 192.168.1.42 6666 # on vc3

on vc3 typed "hello"
on vc1 got nothing
on vc2 got "hello"

on vc1 typed 'lo there'
on vc2 got nothing
on vc3 got nothing

on vc2 typed 'hola'
on vc3 got 'hola'
on vc1 got nothing

killed all the netcats and attempted same proceedure with UDP
netcat:
on vc3 typed 'hello'
on vc2 got 'hello'
on vc1 got nothing

on vc1 typed 'lo there'
on vc2 got nothing
on vc3 got nothing

on vc2 typed 'hola'
at which point I recieved an icmp udp port unreachable and
netcat bailed.
on vc1 got nothing
on vc3 got nothing

I was expecting, based on the TCP experiment that comminication,
that the udp communication would have worked similarly.
I think (more smoke rises and hair starts to smolder) that based
on the experiments there is a small bug somewhere. Though this
could also be perfectly acceptable behavior.

If someone would please clear this up for me and slap me a few
and say "look bucko, that's normal, UDP blows, getover it"
or something I would be much appriciated and wil consider it some
sort of obscure feature.

-- 
   "Reality is what you can get away with!"
                      ++Robert Anton Wilson
   Major'Trips'
   E-Mail   : shadow@cyberwizards.com || major@jimco-fwt.com

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/