FM / html

/usr/share/doc/iptables/html

Name	Size	Mode	Actions
NAT-HOWTO-1.html	1152	0644	edit dl rm
NAT-HOWTO-2.html	4346	0644	edit dl rm
NAT-HOWTO-3.html	1444	0644	edit dl rm
NAT-HOWTO-4.html	4400	0644	edit dl rm
NAT-HOWTO-5.html	5139	0644	edit dl rm
NAT-HOWTO-6.html	8397	0644	edit dl rm
NAT-HOWTO-7.html	1324	0644	edit dl rm
NAT-HOWTO-8.html	1136	0644	edit dl rm
NAT-HOWTO-9.html	2091	0644	edit dl rm
NAT-HOWTO-10.html	2525	0644	edit dl rm
NAT-HOWTO-11.html	910	0644	edit dl rm
NAT-HOWTO.html	2666	0644	edit dl rm
netfilter-extensions-HOWTO-1.html	2102	0644	edit dl rm
netfilter-extensions-HOWTO-2.html	7807	0644	edit dl rm
netfilter-extensions-HOWTO-3.html	28969	0644	edit dl rm
netfilter-extensions-HOWTO-4.html	12548	0644	edit dl rm
netfilter-extensions-HOWTO-5.html	7041	0644	edit dl rm
netfilter-extensions-HOWTO-6.html	11242	0644	edit dl rm
netfilter-extensions-HOWTO-7.html	2188	0644	edit dl rm
netfilter-extensions-HOWTO-8.html	1021	0644	edit dl rm
netfilter-extensions-HOWTO-9.html	2222	0644	edit dl rm
netfilter-extensions-HOWTO.html	7267	0644	edit dl rm
netfilter-hacking-HOWTO-1.html	7474	0644	edit dl rm
netfilter-hacking-HOWTO-2.html	1718	0644	edit dl rm
netfilter-hacking-HOWTO-3.html	8038	0644	edit dl rm
netfilter-hacking-HOWTO-4.html	53338	0644	edit dl rm
netfilter-hacking-HOWTO-5.html	1056	0644	edit dl rm
netfilter-hacking-HOWTO-6.html	3028	0644	edit dl rm
netfilter-hacking-HOWTO-7.html	9288	0644	edit dl rm
netfilter-hacking-HOWTO-8.html	5234	0644	edit dl rm
netfilter-hacking-HOWTO-9.html	835	0644	edit dl rm
netfilter-hacking-HOWTO.html	3811	0644	edit dl rm
packet-filtering-HOWTO-1.html	1891	0644	edit dl rm
packet-filtering-HOWTO-2.html	1593	0644	edit dl rm
packet-filtering-HOWTO-3.html	5775	0644	edit dl rm
packet-filtering-HOWTO-4.html	2189	0644	edit dl rm
packet-filtering-HOWTO-5.html	1644	0644	edit dl rm
packet-filtering-HOWTO-6.html	3505	0644	edit dl rm
packet-filtering-HOWTO-7.html	35616	0644	edit dl rm
packet-filtering-HOWTO-8.html	1457	0644	edit dl rm
packet-filtering-HOWTO-9.html	2333	0644	edit dl rm
packet-filtering-HOWTO-10.html	2575	0644	edit dl rm
packet-filtering-HOWTO-11.html	3742	0644	edit dl rm
packet-filtering-HOWTO.html	2831	0644	edit dl rm

Edit: /usr/share/doc/iptables/html/netfilter-hacking-HOWTO-6.html (3028B)

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
 <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.82">
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <TITLE>Linux netfilter Hacking HOWTO: Netfilter Hooks for Tunnel Writers</TITLE>
 <LINK HREF="netfilter-hacking-HOWTO-7.html" REL=next>
 <LINK HREF="netfilter-hacking-HOWTO-5.html" REL=previous>
 <LINK HREF="netfilter-hacking-HOWTO.html#toc6" REL=contents>
</HEAD>
<BODY>
<A HREF="netfilter-hacking-HOWTO-7.html">Next</A>
<A HREF="netfilter-hacking-HOWTO-5.html">Previous</A>
<A HREF="netfilter-hacking-HOWTO.html#toc6">Contents</A>
<HR>
<H2><A NAME="s6">6.</A> <A HREF="netfilter-hacking-HOWTO.html#toc6">Netfilter Hooks for Tunnel Writers</A></H2>

Authors of tunnel (or encapsulation) drivers should follow two
simple rules for the 2.4 kernel (as do the drivers inside the kernel,
like net/ipv4/ipip.c):

<UL>
<LI>Release skb->nfct if you're going to make the packet unrecognisable
(ie. decapsulating/encapsulating). You don't need to do this if you
unwrap it into a *new* skb, but if you're going to do it in place, you
must do this.

Otherwise: the NAT code will use the old connection tracking
information to mangle the packet, with bad consequences.

</LI>
<LI>Make sure the encapsulated packets go through the LOCAL_OUT
hook, and decapsulated packets go through the PRE_ROUTING hook (most
tunnels use ip_rcv(), which does this for you).

Otherwise: the user will not be able to filter as they expect to with
tunnels.
</LI>
</UL>

The canonical way to do the first is to insert code like the
following before you wrap or unwrap the packet:

<BLOCKQUOTE><CODE>
<PRE>
 /* Tell the netfilter framework that this packet is not the
 same as the one before! */
#ifdef CONFIG_NETFILTER
 nf_conntrack_put(skb->nfct);
 skb->nfct = NULL;
#ifdef CONFIG_NETFILTER_DEBUG
 skb->nf_debug = 0;
#endif
#endif
</PRE>
</CODE></BLOCKQUOTE>

Usually, all you need to do for the second, is to find where the
newly encapsulated packet goes into "ip_send()", and replace it with
something like:

<BLOCKQUOTE><CODE>
<PRE>
 /* Send "new" packet from local host */
 NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, rt->u.dst.dev, ip_send);
</PRE>
</CODE></BLOCKQUOTE>

Following these rules means that the person setting up the packet
filtering rules on the tunnel box will see something like the
following sequence for a packet being tunnelled:

<OL>
<LI> FORWARD hook: normal packet (from eth0 -> tunl0)</LI>
<LI> LOCAL_OUT hook: encapsulated packet (to eth1).</LI>
</OL>

And for the reply packet:
<OL>
<LI> LOCAL_IN hook: encapsulated reply packet (from eth1)</LI>
<LI> FORWARD hook: reply packet (from eth1 -> eth0).</LI>
</OL>

<HR>
<A HREF="netfilter-hacking-HOWTO-7.html">Next</A>
<A HREF="netfilter-hacking-HOWTO-5.html">Previous</A>
<A HREF="netfilter-hacking-HOWTO.html#toc6">Contents</A>
</BODY>
</HTML>

cmd: