forwarding outgoing packets

I have a linux machine on which a software sends packet to an address,is
there a way of configuring the port forwarding on that machine so that the
packets are sent to an address different from the one that the software
believes?

Nicola Gatti <(E-Mail Removed)> wrote:
> I have a linux machine on which a software sends packet to an address,is
> there a way of configuring the port forwarding on that machine so that the
> packets are sent to an address different from the one that the software
> believes?

You could do this easily enough if it were a NAT boundary, with the
REDIRECT target. Otherwise, you would need to send an ICMP datagram with
message-type network-redirect or host-redirect. However, YMMV, as not
every OS will accept these redirects anymore.

Normally, you would send back icmp messages with the -j REJECT and
--reject-with statement, but the ICMP redirect messages are not
represented there.

You would need some small service that listens on the machine, and
responds with the ICMP message (and it would have to run as root, due to
root being the only one who can read and write icmp sockets). I imagine
there may be some software already written to do that, but there is none
packaged under Debian.

Perchance are you seeking something to do with IP mobility?

--
Cameron Kerr
(E-Mail Removed) : http://nzgeeks.org/cameron/
Empowered by Perl!

my streaming software establish a tcp connection for control and an udp
connection for data,i would like to ssh the tcp connection and leave
untouched the udp one,the problem is that if i do an ssh tunnel than i have
to put 127.0.0.1 as destination into my streaming software so also the udp
is sent to 127.0.0.1 while i would like to send udp to my real
destination...

"Cameron Kerr" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Nicola Gatti <(E-Mail Removed)> wrote:
> > I have a linux machine on which a software sends packet to an address,is
> > there a way of configuring the port forwarding on that machine so that
the
> > packets are sent to an address different from the one that the software
> > believes?
>
> You could do this easily enough if it were a NAT boundary, with the
> REDIRECT target. Otherwise, you would need to send an ICMP datagram with
> message-type network-redirect or host-redirect. However, YMMV, as not
> every OS will accept these redirects anymore.
>
> Normally, you would send back icmp messages with the -j REJECT and
> --reject-with statement, but the ICMP redirect messages are not
> represented there.
>
> You would need some small service that listens on the machine, and
> responds with the ICMP message (and it would have to run as root, due to
> root being the only one who can read and write icmp sockets). I imagine
> there may be some software already written to do that, but there is none
> packaged under Debian.
>
> Perchance are you seeking something to do with IP mobility?
>
> --
> Cameron Kerr
> (E-Mail Removed) : http://nzgeeks.org/cameron/
> Empowered by Perl!

Nicola Gatti <(E-Mail Removed)> wrote:
> my streaming software establish a tcp connection for control and an udp
> connection for data,i would like to ssh the tcp connection and leave
> untouched the udp one,the problem is that if i do an ssh tunnel than i have
> to put 127.0.0.1 as destination into my streaming software so also the udp
> is sent to 127.0.0.1 while i would like to send udp to my real
> destination...

You might like to have a look at iproute2, it can do some pretty
advanced stuff. Read the Advanced Routing and Traffic Control HOWTO.

--
Cameron Kerr
(E-Mail Removed) : http://nzgeeks.org/cameron/
Empowered by Perl!

On Tue, 03 Feb 2004 19:31:42 +0100, Nicola Gatti wrote:

> I have a linux machine on which a software sends packet to an address,is
> there a way of configuring the port forwarding on that machine so that the
> packets are sent to an address different from the one that the software
> believes?

Run your own DNS server to respond with the address you want used,
might work with just nslookup file also, but haven't tried it myself
that way.
If the software is hardcoded to a specific ip address, then you could
set up a second ip address but you better isolate it's traffic from going
outbound.
Robert