on my Debian 5 I'm trying to redirect
the TCP traffic generated by my machine
towards 127.0.0.1:5432 (PostgreSQL)
to the new destination 192.168.1.113:5432.
I have tried with iptables many rules, but no one seams good for the task.
Any idea?
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: AANLkTilPUtvPvdqiZJuOUKcpcXCIRFxNy4Oyak7oNCx4@mail .gmail.com">http://lists.debian.org/AANLkTilPUtvPvdqiZJuOUKcpcXCIRFxNy4Oyak7oNCx4@mail .gmail.com
07-09-2010, 06:34 AM
"Boyd Stephen Smith Jr."
IPtables localhost redirect
On Thursday 08 July 2010 22:54:50 Daniele Orlando wrote:
> on my Debian 5 I'm trying to redirect
> the TCP traffic generated by my machine
> towards 127.0.0.1:5432 (PostgreSQL)
> to the new destination 192.168.1.113:5432.
>
> I have tried with iptables many rules, but no one seams good for the task.
>
> Any idea?
What have you tried? It seems like you'd need to change this in a PREROUTING
chain, probably in the mangle table.
Also, depending on the application it my be using the "unix socket" instead of
TCP/IP to connect to PostgreSQL. In that case, iptables would not be
involved.
--
Boyd Stephen Smith Jr. ,= ,-_-. =.
bss@iguanasuicide.net ((_/)o o(\_))
ICQ: 514984 YM/AIM: DaTwinkDaddy `-'(. .)`-'
http://iguanasuicide.net/ \_/
07-09-2010, 03:06 PM
Daniele Orlando
IPtables localhost redirect
On Fri, Jul 9, 2010 at 08:34, Boyd Stephen Smith Jr.
<bss@iguanasuicide.net> wrote:
> What have you tried? *It seems like you'd need to change this in a PREROUTING
> chain, probably in the mangle table.
>
> Also, depending on the application it my be using the "unix socket" instead of
> TCP/IP to connect to PostgreSQL. *In that case, iptables would not be
> involved.
I have tried any configuration of PREROUTING, POSTROUTING, OUTPUT over
nat table.
I have not tried the mangle table, but I know it is used to change the
packet headers,
and I think that is not our case.
I have done many attempt with other protocols and tools (netcat is one of this),
and the problem is note the unix socket because in every case I forced the use
of the 127.0.0.1 host (especially with the the postgres client).
The problem seams to reside in how netfilter process packets on the lo
device and the localhost ip family.
This is a related post in italian:
http://lists.debian.org/debian-italian/2010/07/msg00148.html
And this is the workaround we came:
http://lists.debian.org/debian-italian/2010/07/msg00170.html
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: AANLkTimo4i13eThIVKNXDLJ9IhGgg3EYIRNoioIJs-ch@mail.gmail.com">http://lists.debian.org/AANLkTimo4i13eThIVKNXDLJ9IhGgg3EYIRNoioIJs-ch@mail.gmail.com
07-09-2010, 06:31 PM
Charles Kroeger
IPtables localhost redirect
>Any idea?
My idea would be for you to install a package called 'arno-iptables-firewall'
Then join their list discussions, much good information proffered there to
assist with this problem.
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 20100709143124.56212507@Mondo">http://lists.debian.org/20100709143124.56212507@Mondo
07-09-2010, 08:17 PM
Daniele Orlando
IPtables localhost redirect
On Fri, Jul 9, 2010 at 19:09, Toan Pham <tpham3783@gmail.com> wrote:
> Here's the trick,
>
> # Trick the kernel to route localhost ip (127.0.0.1) in prerouting
> rule, and continue routing out through the valid network interface
> (not the loopback interface).
> ifconfig eth0:0 127.0.0.1
>
> # Setup NAT Table to redirect traffic
> iptables -t nat -A PREROUTING -p tcp --dport 5432 -j DNAT --to
> 192.168.1.113:5432
>
>
> I haven't tried it yet, let me know if it works.
Thanks, but it doesn't work.
Someone said me on a forum:
"""
You cannot redirect loopback traffic with iptables.
"""
I'm investigating this statement.
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: AANLkTikt33Y5uoXl_VYMXzpoDkLe1in_iWDODOSAlbwF@mail .gmail.com">http://lists.debian.org/AANLkTikt33Y5uoXl_VYMXzpoDkLe1in_iWDODOSAlbwF@mail .gmail.com
07-09-2010, 08:30 PM
"Boyd Stephen Smith Jr."
IPtables localhost redirect
On Friday 09 July 2010 10:06:23 Daniele Orlando wrote:
> On Fri, Jul 9, 2010 at 08:34, Boyd Stephen Smith Jr.
> <bss@iguanasuicide.net> wrote:
> > What have you tried? It seems like you'd need to change this in a
> > PREROUTING chain, probably in the mangle table.
>
> I have tried any configuration of PREROUTING, POSTROUTING, OUTPUT over
> nat table.
> I have not tried the mangle table, but I know it is used to change the
> packet headers,
> and I think that is not our case.
One of the packet headers is the destination IP, which you are changing. The
mangle table might be appropriate here. Since you want that change to affect
which interface is used for sending the packet, it must occur in PREROUTING.
That said, I would not be surprised if there is special handling for 127/8 on
lo* devices.
--
Boyd Stephen Smith Jr. ,= ,-_-. =.
bss@iguanasuicide.net ((_/)o o(\_))
ICQ: 514984 YM/AIM: DaTwinkDaddy `-'(. .)`-'
http://iguanasuicide.net/ \_/
07-10-2010, 11:06 AM
Javier Barroso
IPtables localhost redirect
On Fri, Jul 9, 2010 at 5:54 AM, Daniele Orlando <d.orlando.0@gmail.com> wrote:
Hello guys,
on my Debian 5 I'm trying to redirect
the TCP traffic generated by my machine
towards 127.0.0.1:5432 (PostgreSQL)
to the new destination 192.168.1.113:5432.
I have tried with iptables many rules, but no one seams good for the task.
Any idea?
Hi, If you have ssh access to 192.168.1.113, you can try ssh port forwarding, with -L 5432:192.168.1.113:5432 option
Regards,
07-10-2010, 05:00 PM
Mart Frauenlob
IPtables localhost redirect
On 09.07.2010 05:54, Daniele Orlando wrote:
Hello guys,
on my Debian 5 I'm trying to redirect
the TCP traffic generated by my machine
towards 127.0.0.1:5432 (PostgreSQL)
to the new destination 192.168.1.113:5432.
I have tried with iptables many rules, but no one seams good for the task.
Any idea?
This picture shows the netfilter traffic flow:
http://jengelh.medozas.de/images/nf-packet-flow.png
Source address selection is done before the OUTPUT path.
Locally generated packets NEVER hit the PREROUTING chain in mangle or
nat table.
There is a routing decision after the mangle table OUTPUT chain.
But you cannot do address translation there (like in nat OUTPUT).
What you can do, is MARK packets in the mangle table, and refer to this
mark with iproute2 (ip rule add fwmark 0x1 lookup table custom_table) -
this is called "policy based routing".
So from looking at the picture and from the theory I know, theoretically
something like this could work:
fill the table with appropriate routes:
ip route add table custom_table ...
...
mark in mangle table:
iptables -t mangle -A OUTPUT -d 127.0.0.1 -p tcp --dport 5432 -j MARK
--set-mark 0x1
dnat in nat table:
iptables -t nat -A OUTPUT -m mark --mark 0x1 -j DNAT --to-destination
192.168.1.113
snat in nat table:
iptables -t nat -A POSTROUTING -m mark --mark 0x1 -j SNAT --to-source
192.168.1.1?
add iproute rule:
ip rule add fwmark 0x1 lookup custom_table
I've done all this for testing and I did not succeed.
I also did:
echo 0 >/proc/sys/net/ipv4/conf/all/rp_filter
not sure if that interacts.
I then put a trace rule:
iptables -t raw -A OUTPUT -d 127.0.0.1 -p tcp --dport 5432 -j TRACE
The resulting log always ended in the nat table's OUTPUT chain.
I don't know why acutally, from the picture (which is from a developer)
it should hit nat POSTROUTING.
I'm telling you this, so you could eventually try and maybe you have
more luck than me, or maybe the information is otherwise useful.
However maybe it's not possible, I can't tell for sure.
I would have done some ssh tunneling myself in the first place.
But I know there are people at the netfilter mailing list, who do know
for sure. It's in general the best place to ask netfilter related questions.
Best regards
Mart
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
On Sat, Jul 10, 2010 at 13:06, Javier Barroso <javibarroso@gmail.com> wrote:
> Hi, If you have ssh access to 192.168.1.113, you can try ssh port
> forwarding, with -L 5432:192.168.1.113:5432 option
>
> Regards,
Hi Javier,
thanks for the tip.
Your solution is one of the possible workarounds we came.
Another one (I'm using it) can be done with "socat":
socat TCP4-LISTEN:${local_port},fork,reuseaddr
TCP4:${remote_host}:${remote_port}
Credits to the guys of #Netfilter and #debian channels.
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: AANLkTinsKr6Fw_Md8O3v8Meaqtbty-_fFKwlp43Rd2vL@mail.gmail.com">http://lists.debian.org/AANLkTinsKr6Fw_Md8O3v8Meaqtbty-_fFKwlp43Rd2vL@mail.gmail.com
07-11-2010, 11:06 PM
Daniele Orlando
IPtables localhost redirect
On Sat, Jul 10, 2010 at 19:00, Mart Frauenlob <mart.frauenlob@chello.at> wrote:
> This picture shows the netfilter traffic flow:
> http://jengelh.medozas.de/images/nf-packet-flow.png
>
> Source address selection is done before the OUTPUT path.
> Locally generated packets NEVER hit the PREROUTING chain in mangle or nat
> table.
> There is a routing decision after the mangle table OUTPUT chain.
> But you cannot do address translation there (like in nat OUTPUT).
> What you can do, is MARK packets in the mangle table, and refer to this mark
> with iproute2 (ip rule add fwmark 0x1 lookup table custom_table) - this is
> called "policy based routing".
>
>
> So from looking at the picture and from the theory I know, theoretically
> something like this could work:
>
> echo "101 custom_table" >> /etc/iproute2/rt_tables
>
> fill the table with appropriate routes:
> ip route add table custom_table ...
> ...
>
> mark in mangle table:
> iptables -t mangle -A OUTPUT -d 127.0.0.1 -p tcp --dport 5432 -j MARK
> --set-mark 0x1
>
> dnat in nat table:
> iptables -t nat -A OUTPUT -m mark --mark 0x1 -j DNAT --to-destination
> 192.168.1.113
>
> snat in nat table:
> iptables -t nat -A POSTROUTING -m mark --mark 0x1 -j SNAT --to-source
> 192.168.1.1?
>
> add iproute rule:
> ip rule add fwmark 0x1 lookup custom_table
>
>
> I've done all this for testing and I did not succeed.
> I also did:
> echo 0 >/proc/sys/net/ipv4/conf/all/rp_filter
> not sure if that interacts.
> I then put a trace rule:
> iptables -t raw -A OUTPUT -d 127.0.0.1 -p tcp --dport 5432 -j TRACE
>
> The resulting log always ended in the nat table's OUTPUT chain.
> I don't know why acutally, from the picture (which is from a developer) it
> should hit nat POSTROUTING.
> I'm telling you this, so you could eventually try and maybe you have more
> luck than me, or maybe the information is otherwise useful.
> However maybe it's not possible, I can't tell for sure.
> I would have done some ssh tunneling myself in the first place.
> But I know there are people at the netfilter mailing list, who do know for
> sure. It's in general the best place to ask netfilter related questions.
>
> Best regards
>
> Mart
Thanks Mart,
your experiment will not be lost.
At the moment I have not a lot of time to spend extending your work,
but it is a good starting point for further enhancement.
As you are suggesting, I'll integrate it with the infos coming from the
netfilter mailing list and #Netfilter irc channel.
At the moment, the good news is that, together with the ssh,
netcat, and socat animals, we have a new friend:
xinetd
service postgresql
{
socket_type = stream
wait = no
user = root
redirect = 192.168.1.113 5432
bind = 127.0.0.1
}
Thanks again for the time spent answering me.
Daniele
p.s.:
The xinetd tip comes from SuperJediWombat! of linuxquestions.org.
http://www.linuxquestions.org/questions/linux-networking-3/iptables-redirect-127-0-0-1-to-192-168-1-113-a-818817/
--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: AANLkTila28GqHmpb75bm18KCi-H7UFNG0eR53LG9J-YS@mail.gmail.com">http://lists.debian.org/AANLkTila28GqHmpb75bm18KCi-H7UFNG0eR53LG9J-YS@mail.gmail.com
IPtables localhost redirect
