Welcome to Linux Forums! With a comprehensive Linux Forum, information on various types of Linux software and many Linux Reviews articles, we have all the knowledge you need a click away, or accessible via our knowledgeable members.
Find the answer to your Linux question:
New to Linux Forums? Register here for free!
    Linux Forums > GNU Linux Zone > Linux Security > NAT in already established TCP connections

Forgot Password?
 Linux Security   Discussion about keeping your machines secure, and the crackers out.

Site Navigation
Linux Articles
Linux Forums
Linux Downloads
Linux Hosting
Free Magazines
Job Board
IRC Chat
RSS Feeds


Linux Forum Topics
Linux Forums
Your Distro
Linux Resources
GNU Linux Zone
The Community
Reply
 
Thread Tools Display Modes
Old 10-27-2008   #1 (permalink)
Just Joined!
 
Join Date: Oct 2008
Location: Spain
Posts: 1
NAT in already established TCP connections

Hi everybody,

This is my first post in the linux forum.
I hope you can help me:

I use iptables rules to manage the connections from internet to my local network. I know how to filter, do nat, etc...
But this days I'm trying to do NAT in connections that are already established. The problem is (as far as I know) the packets which pass throught the nat table are only the SYN packets (once), thus, the packets that are used to perform a NEW connection.
After that the connection is created, the maintenance and the resolution of the SNAT and DNAT are kept till the connection finish.
What I'm wondering is: how can I change the ports or IPs of an already established connection if my packets just go throught the nat table at the connection time?
  • Maybe doing packets' replication since those ones are redirected to annother machine?
NAT TCP Extensions??Patch-O-Matic --> window-tracking??
  • I read this in http://svn.gnumonks.org/trunk/netfil...ls/doc/nat.txt
    - NEW (and RELATED non-icmp)
    This is a very important part relevant for understanding the whole NAT
    subsystem. Only if the packet has the state NEW (i.e. it would establish
    a new connection, if we'd accept it), the NAT table is traversed by
    calling ip_nat_rule.c:ip_nat_rule_find(), which in turn calls
    ip_tables.c:ipt_do_table() for the actual IP table traversal. The traversal
    ends up in either ACCEPTing the packet as it is, or one of the nat targets
    (SNAT, DNAT and if loaded: REDIRECT, MASQUERADE) Please see
    chapter FIXME for further description of those targets.

    - ESTABLISHED
    This packet belongs to an already established connection. We don't need
    to traverse the NAT table again, as the necessary information
    (struct ip_nat_info) was already gained as the first packet of this
    connection entered the NEW case above. We just use what's in
    the struct ip_conntrack.nat.info.


thank you very much in advance.
Diego.
dieguich is offline  


Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off

Free Magazines
Run Your Own Web Server Using Linux & Apache - Free 191 Page Preview
Learn about everything you'll need to build and maintain your Linux servers, and to deploy Web applications to them.
subscribe
Open Source Security Myths Dispelled
Dispel the five major myths surrounding Open Source Security and gain the tools necessary to make a truly informed decision for your IT organization
subscribe
InformationWeek
InformationWeek is the only newsweekly you'll need to stay on top of the latest developments in information technology.
subscribe



All times are GMT. The time now is 05:28 AM.






© 2000 - 2009 - All Rights Reserved - Property of  MAS Media

Content Relevant URLs by vBSEO 3.3.0 RC2