0

I want to process IP-packets in my app like encrypting them, remove "bad" ones etc if they match some rule (say for example destination ip) and then send to destination. I think I can use for that purpose REDIRECT of iptables. I know that after forwarding packets to my app the original destination address will be overwritten but there is a solution:

iptables overrites the original destination address but it remembers the old one. The application code can then fetch it by asking for a special socket option, SO_ORIGINAL_DST

static int getdestaddr_iptables(int fd, const struct sockaddr_in *client, const struct sockaddr_in *bindaddr, struct sockaddr_in *destaddr)
{
        socklen_t socklen = sizeof(*destaddr);
        int error;

        error = getsockopt(fd, SOL_IP, SO_ORIGINAL_DST, destaddr, &socklen);
        if (error) {
                log_errno(LOG_WARNING, "getsockopt");
                return -1;
        }
        return 0;
}

solution taken from here

For this purpose I also configured IPv4 forwarding by doing this:

sysctl -w net.ipv4.ip_forward=1

But then by trying to set iptable's rule, I've got an error

My rule is: iptables -t nat -A OUTPUT -p ip -j REDIRECT --to-port 666

Error: iptables v1.4.21: Need TCP, UDP, SCTP or DCCP with port specification1

I'm really newbie in iptables and in such theme in general. Can somebody tell me what I doing wrong? Why it can't do redirect with IP? And is my idea correct? I know also about divert-sockets, but they don't support fragmentation.

UPD1 Let me get straight about my problem: I want my device which is connected to internet be kind of gateway for incoming/outgoing connections. And I want to process those packets with help of my app. Some packets I will modify if they match some rule, other - just send forward without any modifications. And the laptop is "getting the internet" with help of that device

Community
  • 1
  • 1
user2123079
  • 656
  • 8
  • 29
  • It seems you are trying to reinvent iptables or a firewall. Why don't you implement your app logic as iptables rules? – MSalters Aug 05 '15 at 11:02
  • Yes, I can handle those packets with help of iptables rules, I understand this. But as I said, I need to modify some of the packets and this is impossible with iptables (encrypt payloads, change src/dst IP etc). That's why I need to do what I want. – user2123079 Aug 05 '15 at 11:08
  • That sounds like a rule for the `mangle` table actually. – MSalters Aug 05 '15 at 11:11
  • But with mangle table I'm only can change TOS, TTL, MARK, SECMARK and CONNSECMARK, but not the payloads. – user2123079 Aug 05 '15 at 11:23

1 Answers1

1

The IP protocol simply does not have port numbers. TCP and UDP both offer 65536 ports, but these are unrelated. One is a 2 byte field in the TCP header, the other is a 2 byte field in the UDP header. ICMP (ping) does not have ports at all.

MSalters
  • 173,980
  • 10
  • 155
  • 350
  • Oops, I missed that moment, maybe because I'm very tired. Thanks. I've posted additional information about the "problem" – user2123079 Aug 05 '15 at 10:54