I am trying to set up a network where the clients first have only access
to my intranet apache server, it does some kind of authentication, i
arping his ip and set up the firewall to let the forwarding of his
computer to the internet even do if he reboot or change IP.
1 state:
iptables -t nat -A PREROUTING -j DNAT --to-destination 10.0.10.2
2 state:
iptables -t nat -I PREROUTING -m mac --mac --mac-source
00:20:18:2D:6B:20 -j ACCEPT
everything is fine till here, but lets say that I want to allow traffic
to the internet from this client for a limited amount of time (i.e. 30
mins)
I would build a crontab job to delete the last iptable rule.
iptables -t nat -D PREROUTING -m mac --mac --mac-source
00:20:18:2D:6B:20 -j ACCEPT
This works if the client now tries to reach a new url.
but if he was browsing a site (i.e. hotmail)
he will continue as nothing happened.
I would not care about killing his etablished connection. On
resestablishing he would be forward it to my server.
On Tue, 2002-10-29 at 07:45, guy keren wrote:
On 29 Oct 2002, Meir Michanie wrote:
with nat table and DNAT target you can redirect new connections.
but how can you break all ready established connections and redirect to
a certain ip?
mangle support established connections but do not support DNAT.
i think at least in the vanilla kernel, this is not supported. normally,
you can not redirect an already established connection.
this makes sense - how would the new target machine know how to
synchronize in on an already established connection, that has an
established state, and established sequence numbers, etc?
can you explain why you find the need to redirect alerady established
connections? perhaps this can be remedied...
--
guy
For world domination - press 1,
or dial 0, and please hold, for the creator. -- nob o. dy
--
QOTD:
I tried buying a goat instead of a lawn tractor; had to return
it though. Couldn't figure out a way to connect the snow blower.
=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]
