Re: NAT to a broadcast addess using iptables?

Hello,

news@xxxxxxxxxxxxxxxxxx a écrit :

I'm an iptables newbie. I have a busybox router that uses iptables
1.2.8. (Sorry if I have the wrong ng, but this seems to be where the
iptables gurus are!)

Oh, so you're looking for iptables gurus... then don't bother to read my reply.

I have a requirement to be able to send a packet
across the internet and have it natted and forwarded to a directed
broadcast address on the internal lan, e.g. UDP 213.1.2.3:9 -->
10.1.2.255/24:9. I've added the PREROUTING and FORWARDING rules which
nat and foward to the broadcast address but a sniffer shows the packet
not arriving. If I change both rules to a specific host (e.g.
10.1.2.1), it works fine. Is what I'm trying to do possible?

Netfilter/iptables itself does not care whether an IP addresse is a broadcast or unicast address (which can cause trouble with connection tracking). But in the Linux kernel IP stack, the DNAT operation in the PREROUTING chain takes place before the input routing decision is taken. So the input routing algorithm receives a packet with a broadcast destination address, but it won't forward such packets. Broadcast packets can only be sent or received locally, not forwarded.

(Yes, I know it's insane, but is it possible!?)

I'm afraid it is not possible to do this with iptables. Is your goal to do some kind of remote wake-on-LAN ?
.

Relevant Pages

  • Google Summer of Code 2009: Student applies to create a Better IPTables Management Tool
    ... a student) and select the Linux Foundation ... The tool focuses on helping the user to perceive what a particular chains of rules in a particular table does to a user specified packet. ... As the project aims for better IPtables management tool, I can contribute with my hard earned 3 years experience in maintenance of firewalls. ... The tools helps the user to either select all the rules in the chain or some particular rules and tells the impact of the application of selected rules upon the incoming/outgoing packet. ...
    (Linux-Kernel)
  • Re: Doubts with iptables (or ipchains)
    ... With iptables use the state module. ... > done with ipchains (using some alternative ... > of the connection would protect my LAN? ... Why would 'a packet' be 52 bytes? ...
    (comp.os.linux.security)
  • iptables: state & forward confusion
    ... $iptables -F -t mangle ... # set a default policy to allow established & related ... packet forwarded to eth1 or eth2...accept those that are explicitly ... forwarded say for outbound web requests and returning responses? ...
    (comp.os.linux.security)
  • iptables: state & forward confusion
    ... $iptables -F -t mangle ... # set a default policy to allow established & related ... packet forwarded to eth1 or eth2...accept those that are explicitly ... forwarded say for outbound web requests and returning responses? ...
    (comp.os.linux.security)
  • Re: iptables: blocking network access for certain UIDs gives error.
    ... > you're familiar with iptables. ... > rule will match something using the owner module, ... > "stealthing" is a complete waste of time, I wouldn't DROP the packet ...
    (Fedora)