Hello,

since I set up a box where all traffic is being redirected to port 80 (yeah) I am unable to connect to it at this moment, and at least try to figure out this myself. So please, if possible give me an idea on the following scenario:

i am using prerouting to forward ALL tcp traffic to port 80, and it works good.

I need to set up just a couple of systems ( source IP's known ) which will pass the NAT without any limits, without the prerouting rules.

Thank you for any suggestions,

paziu

How to break the "grub loader password" in RHEL 3.0
help me pls.

Dont use others..!! "sanjay.linux" please open a new thread for your problem

sanjay.linux, don't hijack other people's threads. Additionally, LQ isn't the right place for getting help on breaking into systems. If you keep asking questions of that nature, you will risk losing your LQ privileges. kirukan, please use the Report button for these types of things in the future. All that being said, both of you should contact me via email if you need to further discuss any of this. For now, lets try and get the thread back on topic by ignoring the previous two posts. BTW, this thread might be moved to Networking soon unless it becomes evident that it's a security issue.

Ok, I got this:

I would like to redirect ALL TCP to port 80 all hosts but two :

iptables -t nat -I PREROUTING -i eth0 -s ! 10.15.11.101 -p tcp -j REDIRECT --to-port 80
iptables -t nat -I PREROUTING -i eth0 -s ! 10.15.11.8 -p tcp -j REDIRECT --to-port 80

and redirect all dest 80 from these two hosts to proxy port 3128:

iptables -t nat -I PREROUTING -i eth0 -s 10.15.11.101 -p tcp --dport 80 -j REDIRECT --to-port 3128
iptables -t nat -I PREROUTING -i eth0 -s 10.15.11.8 -p tcp --dport 80 -j REDIRECT --to-port 3128


now, if I have just 11.101 it works great all dest packets going trough 3128 and all other packets being forwarded. If I add the second 11.8 , all TCP is redirected to 80, incl ssh telnet etc.

my understanding is :
this should forward all traffic to 80 but from 11.101:
iptables -t nat -I PREROUTING -i eth0 -s ! 10.15.11.101 -p tcp -j REDIRECT --to-port 80
and this should redirect only dest 80 from 11.101 to port 3128:
iptables -t nat -I PREROUTING -i eth0 -s 10.15.11.101 -p tcp --dport 80 -j REDIRECT --to-port 3128

it is true and working great, if I have ONE source host, with multiples, i get all 80 dest redirected to 3128 ( which is great ) BUT all other traffic to port 80 ( which is NOT GOOD )



iptables -t nat -nvL:

Chain PREROUTING (policy ACCEPT 49942 packets, 8659K bytes)
pkts bytes target prot opt in out source destination
1 64 REDIRECT tcp -- eth0 * !10.15.11.8 0.0.0.0/0 redir ports 80
1 60 REDIRECT tcp -- eth0 * !10.15.11.101 0.0.0.0/0 redir ports 80
0 0 REDIRECT tcp -- eth0 * 10.15.11.8 0.0.0.0/0 tcp dpt:80 redir ports 3128
0 0 REDIRECT tcp -- eth0 * 10.15.11.101 0.0.0.0/0 tcp dpt:80 redir ports 3128

So what would be the way of specifying rules for multiple hosts, adding several ips to -s for source returns an error since the syntax is not correct,
I do not want to specify a range. just specific hosts,

Thanks a lot!