Redirect ports on localhost

DISCUSSION Ben Yerushalmi 5 participants 10 messages Mar 23, 2004 – Mar 26, 2004

Share & tools

Ben Yerushalmi

author

2004-03-23 20:10 UTC #0 lore raw

Hi,

I'm trying to redirect traffic on my DNS server. I have bind listening on port 5300 (UDP) instead of 53. I've got it working from the internal network but seem to have problem on redirecting localhost traffic. I've tried changing both PREROUTING and OUTPUT chains in the nat table but it doesn't seem to help.

iptables -A PREROUTING -t nat -p udp -i lo --dport domain -j REDIRECT --to-ports 5300

and

iptables -A OUTPUT -t nat -p udp -d localhost --dport domain -j REDIRECT --to-ports 5300

Anyone have luck doing this? What am I missing?

Thanks,
Ben

[email protected]

2004-03-24 02:01 UTC #1 lore raw

Quoted 8 lines

I'm trying to redirect traffic on my DNS server. I have bind listening on port 5300 (UDP) instead of 53. I've got it working from the internal network but seem to have problem on redirecting localhost traffic. I've tried changing both PREROUTING and OUTPUT chains in the nat table but it doesn't seem to help.
iptables -A PREROUTING -t nat -p udp -i lo --dport domain -j REDIRECT --to-ports 5300

Absolutely incredible, within the past 15 minutes I have been trying to do the exact same thing with you -- also, with no luck. Using tcpdump I know that the port 53 packets are there, but from the DNS server logs I know that the packets never arrive at port 5300. I tried (unsuccessfuly) to add essentially the same PREROUTING rule.

Since this worked on my external interfaces but not lo, I'm thinking that maybe PREROUTING doesn't apply to lo? I don't know. The caveat I had encountered when doing this for another interface was making sure that the packet is accepted on that port in the INPUT chain, but that's not the case here for me.

Signature · 1 line

[email protected]

Mark E. Donaldson

2004-03-24 02:52 UTC #2 lore raw

I remember struggling with this a while. Beat my head against the wall for a month. I finally discovered (after enabling bind debugging mode) the problem was in my named.conf file:

##########################
# PORTS
##########################
# The listen-on record contains a list of local network interfaces to listen on. Optionally the port can be

# specified. Default is to listen on all interfaces found on your system.
The default port is 53.
	listen-on port 53 { 192.168.1.1; };
	query-source address * port 53;

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of [email protected]
Sent: Tuesday, March 23, 2004 6:01 PM
To: [email protected]
Subject: Re: Redirect ports on localhost

Quoted 8 lines

I'm trying to redirect traffic on my DNS server. I have bind listening on port 5300 (UDP) instead of 53. I've got it working from the internal network but seem to have problem on redirecting localhost traffic. I've tried changing both PREROUTING and OUTPUT chains in the nat table but it doesn't seem to help.
iptables -A PREROUTING -t nat -p udp -i lo --dport domain -j REDIRECT --to-ports 5300

Signature · 1 line

[email protected]

[email protected]

2004-03-24 02:57 UTC #3 lore raw

Quoted 9 lines

I remember struggling with this a while. Beat my head against the wall for a month. I finally discovered (after enabling bind debugging mode) the problem was in my named.conf file:
##########################
# PORTS
##########################
# The listen-on record contains a list of local network interfaces to listen on. Optionally the port can be

Quoted 4 lines

# specified. Default is to listen on all interfaces found on your
system. The default port is 53.
    listen-on port 53 { 192.168.1.1; };
    query-source address * port 53;

This isn't the case for me, though -- in fact, I'm not using BIND but rather rbldnsd and specifying that I wish to listen on all interfaces. And I know it does respond, because if I run 'nslookup' and then 'set port= 5300' and make my query, there is a response.

But if the port is on the default 53, the PREROUTING doesn't appear to rewrite the destination port.

Signature · 1 line

[email protected]

Alexander Samad

2004-03-24 03:14 UTC #4 lore raw

In reply to Ben Yerushalmi

Quoted 8 lines · Ben Yerushalmi

Hi,
I'm trying to redirect traffic on my DNS server. I have bind listening on port 5300 (UDP) instead of 53. I've got it working from the internal network but seem to have problem on redirecting localhost traffic. I've tried changing both PREROUTING and OUTPUT chains in the nat table but it doesn't seem to help.

Quoted 7 lines

iptables -A PREROUTING -t nat -p udp -i lo --dport domain -j REDIRECT --to-ports 5300
and
iptables -A OUTPUT -t nat -p udp -d localhost --dport domain -j REDIRECT --to-ports 5300

might be of target but will the destination be localhost or the real ip address ?

Quoted 10 lines

Anyone have luck doing this? What am I missing?
Thanks,
Ben

al clethero

2004-03-24 20:31 UTC #5 lore raw

Recently I was trying to redirect traffic on the localhost though for different reasons. I finally came to the conclusion that localhost packets aren't prerouted. Can anyone confirm this?

Quoted 31 lines · Alexander Samad

Quoted 8 lines · Ben Yerushalmi
Hi,
I'm trying to redirect traffic on my DNS server. I have bind listening on port 5300 (UDP) instead of 53. I've got it working from the internal network but seem to have problem on redirecting localhost traffic. I've tried changing both PREROUTING and OUTPUT chains in the nat table but it doesn't seem to help.
Quoted 7 lines
iptables -A PREROUTING -t nat -p udp -i lo --dport domain -j REDIRECT --to-ports 5300
and
iptables -A OUTPUT -t nat -p udp -d localhost --dport domain -j REDIRECT --to-ports 5300
might be of target but will the destination be localhost or the real ip address ?
A
Quoted 10 lines
Anyone have luck doing this? What am I missing?
Thanks,
Ben

Ben Yerushalmi

author

2004-03-24 05:15 UTC #6 lore raw

In reply to Ben Yerushalmi

I have bind listening on port 5300 so named.conf isn't the problem.

I've been using tcpdump to try and troubleshoot the packets. Both the source and destination of the packet are localhost. I noticed that by changing the OUTPUT (and enabling "NAT_LOCAL" in my linux 2.4.25 kernel), tcpdump is fooled into thinking the packet is headed to port 5300 but I think by that point the packet has passed the application layer and bind doesn't see the packet.

Also, I have the filter table accepting EVERYTHING.

# iptables -L -vn
Chain INPUT (policy ACCEPT 18907 packets, 1521K bytes)
 pkts bytes target     prot opt in     out     source               
destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination

Chain OUTPUT (policy ACCEPT 18208 packets, 2540K bytes)
pkts bytes target prot opt in out source
destination

Quoted 18 lines · Ben Yerushalmi

Hi,
I'm trying to redirect traffic on my DNS server. I have bind listening on port 5300 (UDP) instead of 53. I've got it working from the internal network but seem to have problem on redirecting localhost traffic. I've tried changing both PREROUTING and OUTPUT chains in the nat table but it doesn't seem to help.
iptables -A PREROUTING -t nat -p udp -i lo --dport domain -j REDIRECT --to-ports 5300
and
iptables -A OUTPUT -t nat -p udp -d localhost --dport domain -j REDIRECT --to-ports 5300
Anyone have luck doing this? What am I missing?
Thanks,
Ben

Ben Yerushalmi

author

2004-03-25 07:34 UTC #7 lore raw

In reply to Ben Yerushalmi

Looks like changing the OUTPUT chain did actually work in redirecting localhost traffic. On the Linux 2.4 kernel you will need to enable the "NF_NAT_LOCAL" kernel option.

Thanks everyone for their help.

Ben