FM / html

/usr/share/doc/iptables/html

Name	Size	Mode	Actions
NAT-HOWTO-1.html	1152	0644	edit dl rm
NAT-HOWTO-2.html	4346	0644	edit dl rm
NAT-HOWTO-3.html	1444	0644	edit dl rm
NAT-HOWTO-4.html	4400	0644	edit dl rm
NAT-HOWTO-5.html	5139	0644	edit dl rm
NAT-HOWTO-6.html	8397	0644	edit dl rm
NAT-HOWTO-7.html	1324	0644	edit dl rm
NAT-HOWTO-8.html	1136	0644	edit dl rm
NAT-HOWTO-9.html	2091	0644	edit dl rm
NAT-HOWTO-10.html	2525	0644	edit dl rm
NAT-HOWTO-11.html	910	0644	edit dl rm
NAT-HOWTO.html	2666	0644	edit dl rm
netfilter-extensions-HOWTO-1.html	2102	0644	edit dl rm
netfilter-extensions-HOWTO-2.html	7807	0644	edit dl rm
netfilter-extensions-HOWTO-3.html	28969	0644	edit dl rm
netfilter-extensions-HOWTO-4.html	12548	0644	edit dl rm
netfilter-extensions-HOWTO-5.html	7041	0644	edit dl rm
netfilter-extensions-HOWTO-6.html	11242	0644	edit dl rm
netfilter-extensions-HOWTO-7.html	2188	0644	edit dl rm
netfilter-extensions-HOWTO-8.html	1021	0644	edit dl rm
netfilter-extensions-HOWTO-9.html	2222	0644	edit dl rm
netfilter-extensions-HOWTO.html	7267	0644	edit dl rm
netfilter-hacking-HOWTO-1.html	7474	0644	edit dl rm
netfilter-hacking-HOWTO-2.html	1718	0644	edit dl rm
netfilter-hacking-HOWTO-3.html	8038	0644	edit dl rm
netfilter-hacking-HOWTO-4.html	53338	0644	edit dl rm
netfilter-hacking-HOWTO-5.html	1056	0644	edit dl rm
netfilter-hacking-HOWTO-6.html	3028	0644	edit dl rm
netfilter-hacking-HOWTO-7.html	9288	0644	edit dl rm
netfilter-hacking-HOWTO-8.html	5234	0644	edit dl rm
netfilter-hacking-HOWTO-9.html	835	0644	edit dl rm
netfilter-hacking-HOWTO.html	3811	0644	edit dl rm
packet-filtering-HOWTO-1.html	1891	0644	edit dl rm
packet-filtering-HOWTO-2.html	1593	0644	edit dl rm
packet-filtering-HOWTO-3.html	5775	0644	edit dl rm
packet-filtering-HOWTO-4.html	2189	0644	edit dl rm
packet-filtering-HOWTO-5.html	1644	0644	edit dl rm
packet-filtering-HOWTO-6.html	3505	0644	edit dl rm
packet-filtering-HOWTO-7.html	35616	0644	edit dl rm
packet-filtering-HOWTO-8.html	1457	0644	edit dl rm
packet-filtering-HOWTO-9.html	2333	0644	edit dl rm
packet-filtering-HOWTO-10.html	2575	0644	edit dl rm
packet-filtering-HOWTO-11.html	3742	0644	edit dl rm
packet-filtering-HOWTO.html	2831	0644	edit dl rm

Edit: /usr/share/doc/iptables/html/netfilter-extensions-HOWTO-5.html (7041B)

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
 <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.82">
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <TITLE>Netfilter Extensions HOWTO: New connection tracking patches</TITLE>
 <LINK HREF="netfilter-extensions-HOWTO-6.html" REL=next>
 <LINK HREF="netfilter-extensions-HOWTO-4.html" REL=previous>
 <LINK HREF="netfilter-extensions-HOWTO.html#toc5" REL=contents>
</HEAD>
<BODY>
<A HREF="netfilter-extensions-HOWTO-6.html">Next</A>
<A HREF="netfilter-extensions-HOWTO-4.html">Previous</A>
<A HREF="netfilter-extensions-HOWTO.html#toc5">Contents</A>
<HR>
<H2><A NAME="s5">5.</A> <A HREF="netfilter-extensions-HOWTO.html#toc5">New connection tracking patches</A></H2>

<P>In this sections, we will show the available connection tracking/nat patches.
To use them, simply load the corresponding modules (with options if needed)
for them to be in effect.</P>

<H2><A NAME="ss5.1">5.1</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.1">amanda-conntrack-nat patch</A>
</H2>

<P>This patch by Brian J. Murrell &lt;netfilter@interlinx.bc.ca&gt; adds support
for connection tracking and nat of the Amanda backup tool protocol.</P>

<H2><A NAME="ss5.2">5.2</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.2">eggdrop-conntrack patch</A>
</H2>

<P>This patch by Magnus Sandin &lt;magnus@sandin.cx&gt; adds support
for connection tracking for eggdrop bot networks.</P>

<H2><A NAME="ss5.3">5.3</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.3">h323-conntrack-nat patch</A>
</H2>

<P>This patch by Jozsef Kadlecsik &lt;kadlec@blackhole.kfki.hu&gt; adds
H.323/netmeeting support module for netfilter connection tracking and NAT.</P>

<P>H.323 uses/relies on the following data streams :</P>
<P>
<UL>
<LI>port 389 -&gt; Internet Locator Server (TCP).</LI>
<LI>port 522 -&gt; User Location Server (TCP).</LI>
<LI>port 1503 -&gt; T.120 Protocol (TCP).</LI>
<LI>port 1720 -&gt; H.323 (H.225 call setup, TCP)</LI>
<LI>port 1731 -&gt; Audio call control (TCP)</LI>
<LI>Dynamic port -&gt; H.245 call control (TCP)</LI>
<LI>Dynamic port -&gt; RTCP/RTP streaming (UDP)</LI>
</UL>
</P>

<P>The H.323 conntrack/NAT modules support the connection tracking/NATing of
the data streams requested on the dynamic ports. The helpers use the
search/replace hack from the ip_masq_h323.c module for the 2.2 kernel
series.</P>

<P>At the very minimum, H.323/netmeeting (video/audio) is functional by letting
trough the 1720 port and loading these H.323 module(s).</P>

<P>The H.323 conntrack/NAT modules do not support :</P>
<P>
<UL>
<LI>H.245 tunnelling</LI>
<LI>H.225 RAS (gatekeepers)</LI>
</UL>
</P>

<H2><A NAME="ss5.4">5.4</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.4">irc-conntrack-nat patch</A>
</H2>

<P>This patch by Harald Welte &lt;laforge@gnumonks.org&gt; allows DCC to work though NAT and
connection tracking. By default, this module will track IRC connection on port 6667.
But you can change this for another port with the `ports=xx' argument.</P>

<H2><A NAME="ss5.5">5.5</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.5">mms-conntrack-nat patch</A>
</H2>

<P>This patch by Filip Sneppe &lt;filip.sneppe@cronos.be&gt; adds support for
connection tracking of Microsoft Streaming Media Services protocol.</P>

<P>This allows client (Windows Media Player) and server
to negotiate protocol (UDP, TCP) and port for the media stream.
A partially reverse engineered protocol analysis is available
from 
<A HREF="http://get.to/sdp">here</A>, together with a link to a Linux client.</P>

<P>It is recommended to open UDP port 1755 to the server, as this port is used
for retransmission requests.</P>

<P>This helper has been tested in SNAT and DNAT setups.</P>

<H2><A NAME="ss5.6">5.6</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.6">pptp patch</A>
</H2>

<P>This patch by Harald Welte &lt;laforge@gnumonks.org&gt; allows netfilter to track pptp connection as well as to NAT them.</P>

<H2><A NAME="ss5.7">5.7</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.7">quake3-conntrack patch</A>
</H2>

<P>This patch by Filip Sneppe &lt;filip.sneppe@cronos.be&gt; adds support for
Quake III Arena connection tracking and nat.</P>

<H2><A NAME="ss5.8">5.8</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.8">rsh patch</A>
</H2>

<P>This patch by Ian Larry Latter &lt;Ian.Latter@mq.edu.au&gt; adds support for
RSH connection tracking.</P>

<P>An RSH connection tracker is required if the dynamic stderr "Server
to Client" connection is to occur during a normal RSH session.  This
typically operates as follows :</P>
<P>
<BLOCKQUOTE><CODE>
<PRE>
    Client 0:1023 --> Server 514    (stream 1 - stdin/stdout)
    Client 0:1023 &lt;-- Server 0:1023 (stream 2 - stderr)
</PRE>
</CODE></BLOCKQUOTE>
</P>

<P>The author of this patch is warning you that this module could be dangerous, and
that it is not "best practice" to use RSH, and you should use SSH in all instances.</P>

<H2><A NAME="ss5.9">5.9</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.9">snmp-nat patch</A>
</H2>

<P>This patch by James Morris &lt;jmorris@intercode.com.au&gt; allows netfilter to NAT basic SNMP
This is the ``basic'' form of SNMP-ALG, as described in
<A HREF="http://www.faqs.org/rfcs/rfc2962.html">RFC 2962</A>,
it works by modifying IP addresses inside SNMP payloads
to match IP-layer NAT mapping.</P>

<H2><A NAME="ss5.10">5.10</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.10">talk-conntrack-nat patch</A>
</H2>

<P>This patch by Jozsef Kadlecsik &lt;kadlec@blackhole.kfki.hu&gt; allows netfilter to track
talk connections, as well as to NAT them. By default both otalk (UDP port 517) and talk (UDP port 518) are
supported. otalk/talk supports can selectively be enabled/disabled
by the module parameters of the ip_conntrack_talk and ip_nat_talk modules. The options are :</P>
<P>
<UL>
<LI>otalk = 0 | 1</LI>
<LI>talk = 0 | 1</LI>
</UL>
</P>

<P>where `0' means `do not support' while `1' means `do support'
the given protocol flavor.</P>

<H2><A NAME="ss5.11">5.11</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.11">tcp-window-tracking patch</A>
</H2>

<P>This patch by Jozsef Kadlecsik &lt;kadlec@blackhole.kfki.hu&gt; allows netfilter
do TCP connection tracking according to the article
<A HREF="http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz">Real Stateful TCP Packet Filtering in IP Filter</A> by
Guido van Rooij. It supports window scaling, and can now handle already established connections.</P>

<H2><A NAME="ss5.12">5.12</A> <A HREF="netfilter-extensions-HOWTO.html#toc5.12">tftp patch</A>
</H2>

<P>This patch by Magnus Boden &lt;mb@ozaba.mine.nu&gt; allows netfilter to track
tftp connections as well as to NAT them. By default, this module will track
tftp connections on port 69. But you can change this for another port with the
`ports=xx' argument.</P>

<HR>
<A HREF="netfilter-extensions-HOWTO-6.html">Next</A>
<A HREF="netfilter-extensions-HOWTO-4.html">Previous</A>
<A HREF="netfilter-extensions-HOWTO.html#toc5">Contents</A>
</BODY>
</HTML>

cmd: