RE: port forwarding

Have you looked at nocat.net? It does what you are trying except on 443. 

Check out airinter.net for mgmt add on. 

DMZ 

-----Original Message-----
From: "Christophe Vandeplas"<security@vandeplas.com>
Sent: 06/20/05 11:24:28 AM
To: "firewalls@securityfocus.com"<firewalls@securityfocus.com>
Cc: 
Subject: port forwarding


I am working on a kind of authentication system enabling users to
'login' on a network using a webinterface.

This webinterface adds the ip of the user into the firewall (loggedUsers
chain) so that his packets are forwarded across the gateway transparently.


This all works from now on.

But, to make it more userfriendly I would like to automatically redirect
 requests of port 80 (http) and 443 (https) to the authentication system
so that the user can login. This using iptables

I applied these nice rules, and it works like a charm...except that it
_always_ forwards the port, something I do not want.

$IPTABLES -t nat -A PREROUTING -p tcp -i $INTIF -d $UNIVERSE --dport 80
-j DNAT --to $INTIP:80
$IPTABLES -A FORWARD -p tcp -i $INTIF -o $INTIF -d $INTIP --dport 80 -m
state --state NEW -j ACCEPT


Some more info about the forward chain of my firewall:
$IPTABLES -A FORWARD -j loggedUsers        # call the chain loggedUsers
$IPTABLES -A FORWARD -j drop-and-log-it    # drop the other stuff

So my question is: Is there a way to not forward the port for specific
ip's? (or something to get the same results)


Thanks in advance

Christophe