Messages in this thread | | | Date | Mon, 4 Jan 1999 01:46:12 -0600 | From | "Major'Trips'" <> | Subject | Re: IP Firewalling/Redirect |
| |
On Sun, Jan 03, 1999 at 05:50:38AM -0600, Major'Trips' wrote: > This I assumed would redirect any requests from the local network > to port 54 to be handled by the second named. This failed misserably. > It turns out that the redirection does not function if the initial > destination port ( port 53 ) is bound to. > ( so far only true for named for unknown reasons )
I "think" ( smoke again ) that the reason it is true for named so far is that it appears to only be a real problem on the UDP side.
Experiment: ipchains rules: ipchains -F ipchains -A input -p 6 -s 0/0 -d 192.168.1.42 6666 -j REDIRECT 6667 -l ipchains -A input -p 17 -s 0/0 -d 192.168.1.42 6666 -j REDIRECT 6667 -l
netcat: nc -l -p 6666 # on vc1 nc -l -p 6667 # on vc2 nc 192.168.1.42 6666 # on vc3
on vc3 typed "hello" on vc1 got nothing on vc2 got "hello" on vc1 typed 'lo there' on vc2 got nothing on vc3 got nothing
on vc2 typed 'hola' on vc3 got 'hola' on vc1 got nothing
killed all the netcats and attempted same proceedure with UDP netcat: on vc3 typed 'hello' on vc2 got 'hello' on vc1 got nothing
on vc1 typed 'lo there' on vc2 got nothing on vc3 got nothing
on vc2 typed 'hola' at which point I recieved an icmp udp port unreachable and netcat bailed. on vc1 got nothing on vc3 got nothing
I was expecting, based on the TCP experiment that comminication, that the udp communication would have worked similarly. I think (more smoke rises and hair starts to smolder) that based on the experiments there is a small bug somewhere. Though this could also be perfectly acceptable behavior.
If someone would please clear this up for me and slap me a few and say "look bucko, that's normal, UDP blows, getover it" or something I would be much appriciated and wil consider it some sort of obscure feature. -- "Reality is what you can get away with!" ++Robert Anton Wilson Major'Trips' E-Mail : shadow@cyberwizards.com || major@jimco-fwt.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |