| Message ID | 1279791964.2467.12.camel@edumazet-laptop |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | David Miller |
| Headers | show |
On Thu, Jul 22, 2010 at 5:46 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > Le jeudi 22 juillet 2010 à 17:10 +0800, Changli Gao a écrit : > >> >> I think maybe REDIRECT is enough. If the public port is one of the >> real ports, you need to append "random" option to iptables target >> REDIRECT. If not, "REDIRECT --to-ports 1000-1007" is good enough, and >> the destination port will be selected in the round-robin manner. >> > > Yes, on 2.6.32, no RPS, so undocumented --random option is probably the > best we can offer. (random option was added in 2.6.22) > > iptables -t nat -A PREROUTING -p tcp --dport 1234 -j REDIRECT --random --to-port 1000-1007 > > Here is a patch to add "random" help to REDIRECT iptables target > FYI: the random option is documented in the manual page of iptables. REDIRECT This target is only valid in the nat table, in the PREROUTING and OUT- PUT chains, and user-defined chains which are only called from those chains. It redirects the packet to the machine itself by changing the destination IP to the primary address of the incoming interface (locally-generated packets are mapped to the 127.0.0.1 address). --to-ports port[-port] This specifies a destination port or range of ports to use: without this, the destination port is never altered. This is only valid if the rule also specifies -p tcp or -p udp. --random If option --random is used then port mapping will be randomized (kernel >= 2.6.22).
Le jeudi 22 juillet 2010 à 17:52 +0800, Changli Gao a écrit : > > FYI: the random option is documented in the manual page of iptables. > > REDIRECT > This target is only valid in the nat table, in the PREROUTING and OUT- > PUT chains, and user-defined chains which are only called from those > chains. It redirects the packet to the machine itself by changing the > destination IP to the primary address of the incoming interface > (locally-generated packets are mapped to the 127.0.0.1 address). > > --to-ports port[-port] > This specifies a destination port or range of ports to use: > without this, the destination port is never altered. This is > only valid if the rule also specifies -p tcp or -p udp. > > --random > If option --random is used then port mapping will be randomized > (kernel >= 2.6.22). > > Note my patch has nothing to do with the man page, its already up2date. I usually dont read the Fine manuals, do you ? Try : iptables -t nat -A PREROUTING -p tcp --dport 1234 -j REDIRECT --help REDIRECT target options: --to-ports <port>[-<port>] Port (range) to map to. You see [--random] is missing. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Thu, Jul 22, 2010 at 5:59 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > Le jeudi 22 juillet 2010 à 17:52 +0800, Changli Gao a écrit : > >> >> FYI: the random option is documented in the manual page of iptables. >> >> REDIRECT >> This target is only valid in the nat table, in the PREROUTING and OUT- >> PUT chains, and user-defined chains which are only called from those >> chains. It redirects the packet to the machine itself by changing the >> destination IP to the primary address of the incoming interface >> (locally-generated packets are mapped to the 127.0.0.1 address). >> >> --to-ports port[-port] >> This specifies a destination port or range of ports to use: >> without this, the destination port is never altered. This is >> only valid if the rule also specifies -p tcp or -p udp. >> >> --random >> If option --random is used then port mapping will be randomized >> (kernel >= 2.6.22). >> >> > > Note my patch has nothing to do with the man page, its already up2date. > > I usually dont read the Fine manuals, do you ? Yea. And I don't object your patch. so I add FYI. Thanks. > > Try : > > iptables -t nat -A PREROUTING -p tcp --dport 1234 -j REDIRECT --help > > REDIRECT target options: > --to-ports <port>[-<port>] > Port (range) to map to. > > > You see [--random] is missing. > >
Am 22.07.2010 11:46, schrieb Eric Dumazet: > [PATCH] extensions: REDIRECT: add random help > Applied, thanks Eric. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/extensions/libipt_REDIRECT.c b/extensions/libipt_REDIRECT.c index 3dfcadf..324d0eb 100644 --- a/extensions/libipt_REDIRECT.c +++ b/extensions/libipt_REDIRECT.c @@ -17,7 +17,8 @@ static void REDIRECT_help(void) printf( "REDIRECT target options:\n" " --to-ports <port>[-<port>]\n" -" Port (range) to map to.\n"); +" Port (range) to map to.\n" +" [--random]\n"); } static const struct option REDIRECT_opts[] = {