LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 01-14-2002, 06:23 PM   #1
FunkFlex
Member
 
Registered: Jan 2002
Location: UK
Distribution: Redhat 7.2
Posts: 35

Rep: Reputation: 15
Question IPTables - DNAT, SNAT, port forwarding


Is it possible to port forward to LAN rather than a specific destination IP,

i.e. port forward -> 192.168.0.0/24
instead of port fwd -> 192.168.0.5

if so what are the command chains for this?

this is what i use for standard IP# specific port fwd:
$IPT -t nat -A POSTROUTING -p tcp --dport 80 -o $IEXT -j DNAT --to 192.168.0.2
(this works OK)

Any ideas?
 
Old 01-15-2002, 10:23 AM   #2
raz
Member
 
Registered: Apr 2001
Location: London
Posts: 408

Rep: Reputation: 31
No it's not going to work.

First you need to understand why.

Your trying to do something called distributed Multicasting to a multicast group on your local network to get valid responses from all the web services on the localLan. "like why would this be of any benefit to anyone other then a DOS attack to your own network."

Unicast = 1 > 1
Broadcast = 1 > all "non routable"
Multicast = 1 > all in a Class D group. "only routable through multicast routers"

Also the response back from the web services would have to be UDP as not to bring down the network and this would cause even more headaches.

If your trying to do load balancing on web services then you would use a simple round robin DNS method, but with external ip addresses.

/raz
 
1 members found this post helpful.
Old 01-15-2002, 07:18 PM   #3
FunkFlex
Member
 
Registered: Jan 2002
Location: UK
Distribution: Redhat 7.2
Posts: 35

Original Poster
Rep: Reputation: 15
Thumbs up Now I understand!!

Ahhh..
Now I understand..
it causes a greater security risk
and port forwarding is not possible and not recommended to broadcasts and multicasts

Thanks for your help..

"Now I Know" - The FunkFlex
 
0 members found this post helpful.
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Help with iptables/DNAT/forwarding lohb1ac Linux - Networking 2 12-05-2005 08:48 AM
MASQUERADE vs. DNAT/SNAT Palula Linux - Networking 9 08-12-2005 10:23 AM
IPTables: DNAT, SNAT and Masquerading tarballed Linux - Security 3 12-10-2004 03:45 PM
Port Forwarding using iptables-DNAT radupastia Linux - Networking 2 07-18-2003 02:14 AM
DNAT Help(port forwarding) jrmann1999 Linux - Networking 1 08-09-2001 10:58 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 08:37 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration