diff options
| author | Phil Sutter <phil@nwl.cc> | 2022-11-02 21:54:41 +0100 |
|---|---|---|
| committer | Phil Sutter <phil@nwl.cc> | 2022-11-11 19:13:10 +0100 |
| commit | 7dbd1b1dd95449b1ab8c35cd35fe904eb35db374 (patch) | |
| tree | 313c8e4c25e596d9a7e5150e4be5ecf56e3d8e4c /extensions/libxt_REDIRECT.txlate | |
| parent | c3432977d9a5e6c5d8e835094dc8c466a5d64f03 (diff) | |
extensions: *NAT: Drop NF_NAT_RANGE_PROTO_RANDOM* flag checks
SNAT, DNAT and REDIRECT extensions tried to prevent
NF_NAT_RANGE_PROTO_RANDOM flag from being set if no port or address was
also given.
With SNAT and DNAT, this is not possible as the respective
--to-destination or --to-source parameters are mandatory anyway.
Looking at the kernel code, doing so with REDIRECT seems harmless.
Moreover, nftables supports 'redirect random' without specifying a
port-range.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Diffstat (limited to 'extensions/libxt_REDIRECT.txlate')
| -rw-r--r-- | extensions/libxt_REDIRECT.txlate | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/extensions/libxt_REDIRECT.txlate b/extensions/libxt_REDIRECT.txlate index 2c536495..36419a46 100644 --- a/extensions/libxt_REDIRECT.txlate +++ b/extensions/libxt_REDIRECT.txlate @@ -16,6 +16,9 @@ nft add rule ip nat prerouting tcp dport 80 counter redirect to :10-22 iptables-translate -t nat -A prerouting -p tcp --dport 80 -j REDIRECT --to-ports 8080 --random nft add rule ip nat prerouting tcp dport 80 counter redirect to :8080 random +iptables-translate -t nat -A prerouting -j REDIRECT --random +nft add rule ip nat prerouting counter redirect random + ip6tables-translate -t nat -A prerouting -p tcp --dport 80 -j REDIRECT nft add rule ip6 nat prerouting tcp dport 80 counter redirect |