Individual Suite pages:[summary] [combined] [base] [broken] [extra] [not-accepted] [obsolete] [oldnat] [optimizations] [pending] [submitted] [userspace]
base depends on: submitted pending
Patches which are working fine together
Author: Fabrice MARIE <firstname.lastname@example.org> Status: Works For Me. This option adds CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP, which supplies a target module that will allow you to strip all the IP options from a packet. The target doesn't take any option, and therefore is extremly easy to use : # iptables -t mangle -A PREROUTING -j IPV4OPTSSTRIP # iptables -t mangle --list -n Chain PREROUTING (policy ACCEPT) target prot opt source destination IPV4OPTSSTRIP all -- 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT) target prot opt source destination
Author: Gianni Tedesco <email@example.com> Status: Working, will not go into main kernel This patch adds CONFIG_IP_NF_TARGET_NETLINK, which adds a NETLINK target that sends dropped packets to userspace via a netlink socket. It replaces the old ipchains -o option.
Author: Svenning Soerensen <firstname.lastname@example.org> Status: Experimental This adds CONFIG_IP_NF_TARGET_NETMAP option, which provides a target for the nat table. It creates a static 1:1 mapping of the network address, while keeping host addresses intact. It can be applied to the PREROUTING chain to alter the destination of incoming connections, to the POSTROUTING chain to alter the source of outgoing connections, or both (with separate rules). Examples: iptables -t nat -A PREROUTING -d 18.104.22.168/24 -j NETMAP --to 22.214.171.124/24 iptables -t nat -A POSTROUTING -s 126.96.36.199/24 -j NETMAP --to 188.8.131.52/24
Author: Harald Welte <email@example.com> Status: In Development, REQUIRES ipv6-fixes.patch This adds CONFIG_IP6_NF_TARGET_REJECT option, which adds a REJECT target to ip6tables. Please keep in mind that the icmp-types are different from the icmpv6 types (see ip6tables -j REJECT -h for more info)
Author: Martin Josefsson <firstname.lastname@example.org> Status: In Development/Works For Me This adds CONFIG_IP_NF_TARGET_SAME option, which is similar to SNAT: it takes a range of addresses (`--to 184.108.40.206-220.127.116.11') and gives a client the same address for each connection. It has a --nodst option to make it not use the destination-ip in the calculations when selecting the new source-ip Now it has support for multiple ranges, including 1-address ranges. THIS PATCH IS INCOMPATIBLE WITH dropped-table.patch
Author: Harald Welte <email@example.com> Status: Stable, needs new checksum handling This adds CONFIG_IP_NF_TARGET_TTL option, which enables the user to set the TTL value of an IP packet or to increment / decrement it by a given value.
Author: Andras Kis-Szabo <firstname.lastname@example.org> Status: It works 4 me! These two match extensions (`ah' and `esp') allow you to match a range of SPIs inside AH or ESP headers of IPv6 packets. AH options: --ahspi [!] spi[:spi] match spi (range) --ahlen [!] length total length of this header --ahres check the reserved filed, too ESP option: --espspi [!] spi[:spi] match spi (range)
Author: Andras Kis-Szabo <email@example.com> Status: It works 4 me! This match extension (`frag') allow you to select the packet based on the fileds of the fragmentation header of the IPv6 packets. FRAG options: --fragid [!] id[:id] match the id (range) --fraglen [!] length total length of this header --fragres check the reserved filed, too --fragfirst matches on the first fragment [--fragmore|--fraglast] there are more fragments or this is the last one
Author: Hime Aguiar e Oliveira Jr. <firstname.lastname@example.org> Status: Under development , but works . This option adds CONFIG_IP_NF_MATCH_FUZZY, which allows you to match packets according to a dynamic profile implemented by means of a simple Fuzzy Logic Controller (FLC) . Suppported options are: --upper-limit => Desired upper bound for traffic rate --lower-limit => Lower bound over which the FLC starts to limit traffic
Author: Gerd Knorr <email@example.com> Status: ItWorksForMe[tm] This adds CONFIG_IP_NF_MATCH_IPLIMIT match allows you to restrict the number of parallel TCP connections to a server per client IP address (or address block). Examples: # allow 2 telnet connections per client host iptables -p tcp --syn --dport 23 -m iplimit --iplimit-above 2 -j REJECT # you can also match the other way around: iptables -p tcp --syn --dport 23 -m iplimit ! --iplimit-above 2 -j ACCEPT # limit the nr of parallel http requests to 16 per class C sized # network (24 bit netmask) iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16 \ --iplimit-mask 24 -j REJECT
Author: Maciej Soltysiak <firstname.lastname@example.org> Status: Works for me This patch extends unclean's module to match packets with IP unused bit set. This bit is the first bit in fragmentation offset of the IP header. The offset contains 2 fields: 3 bit fragmentation flags 13 bit fragmentation offset Exerpt from RFC 791: Flags: 3 bits Various Control Flags. Bit 0: reserved, must be zero Bit 1: (DF) 0 = May Fragment, 1 = Don't Fragment. Bit 2: (MF) 0 = Last Fragment, 1 = More Fragments. 0 1 2 +---+---+---+ | | D | M | | 0 | F | F | +---+---+---+ This adds what i see as a security feature to the unclean match, as the bit may be used in very discrete OS fingerprinting as described by Ofir Arkin in "Unverified Fields - A Problem with Firewalls & Firewall Technology Today" available to read at: http://www.sys-security.com/archive/papers/Unverified_Fields_1.0.pdf http://www.sys-security.com/archive/papers/Unverified_Fields_1.0.ps
Author: Fabrice MARIE <email@example.com> Status: experimental This option adds CONFIG_IP_NF_MATCH_IPV4OPTIONS, which supplies ip options match. Suppported options are: --ssrr To match packets with the flag strict source routing. --lsrr To match packets with the flag loose source routing. --no-srr To match packets with no flag for source routing. [!] --rr To match packets with the RR flag. [!] --ts To match packets with the TS flag. [!] --ra To match packets with the router-alert option. [!] --any-opt To match a packet with at least one IP option, or no IP option at all if ! is chosen. Example: $ iptables -A input -m ipv4options --rr -j DROP will drop packets with the record-route flag. $ iptables -A input -m ipv4options --ts -j DROP will drop packets with the timestamp flag. Bug ? I tested --ts and --rr, but not source routing issues, nor the router-alert since I don't know enough about them. So please let me know if it works or doesn't work :)
Author: Brad Chapman (firstname.lastname@example.org) Andras Kis-Szabo
Status: Under development, please test it! This match allows you to match the specialty headers of an IPv6 packet. The list can be found from the help message of the match module. The usage of the module is as follows (e.g.): ip6tables -t filter -A INPUT -m ipv6header --header frag -j ACCEPT ip6tables -t filter -A INPUT -m ipv6header --header 44 -j ACCEPT ip6tables -t filter -A INPUT -m ipv6header --header route --soft -j ACCEPT syntax: --header [!] headers --soft Supported formats: hop,dst,route,frag,auth,esp,none,prot hop-by-hop,ipv6-opts,ipv6-route,ipv6-frag,ah,esp,ipv6-nonxt,protocol 0,60,43,44,51,50,59 proto means that the packet has got a protocol payload. The soft mode means that the packet contains the header. Warning: there is a problem with the fragmented packets! If there is an extension-header after the fragmentation header, we can match them only in the first fragment!
Author: Andreas Ferber <email@example.com> Status: It works for me. This module is an enhanced multiport match. It has support for byte ranges as well as for single ports. Examples: # iptables -A FORWARD -p tcp -m mport --ports 23:42,65 Up to 15 ports are allowed. Note that a portrange uses up 2 port values.
Author: Fabrice MARIE <firstname.lastname@example.org> Status: Works For Me. This option adds CONFIG_IP_NF_MATCH_NTH, which supplies a match module that will allow you to match every Nth packet encountered. By default there are 16 different counters that can be used. This match functions in one of two ways 1) Match ever Nth packet, and only the Nth packet. example: iptables -t mangle -A PREROUTING -m nth --every 10 -j DROP This rule will drop every 10th packet. 2) Unique rule for every packet. This is an easy and quick method to produce load-balancing for both inbound and outbound. example: iptables -t nat -A POSTROUTING -o eth0 -m nth --counter 7 \ --every 3 --packet 0 -j SNAT --to-source 10.0.0.5 iptables -t nat -A POSTROUTING -o eth0 -m nth --counter 7 \ --every 3 --packet 1 -j SNAT --to-source 10.0.0.6 iptables -t nat -A POSTROUTING -o eth0 -m nth --counter 7 \ --every 3 --packet 2 -j SNAT --to-source 10.0.0.7 This example evenly splits connections between the three SNAT addresses. By using the mangle table and iproute2, you can setup complex load-balanced routing. There's lot of other uses. Be creative! Suppported options are: --every Nth Match every Nth packet [--counter] num Use counter 0-15 (default:0) [--start] num Initialize the counter at the number 'num' instead of 0. Must be between 0 and Nth-1 [--packet] num Match on 'num' packet. Must be between 0 and Nth-1. If --packet is used for a counter than there must be Nth number of --packet rules, covering all values between 0 and Nth-1 inclusively.
Author: Andras Kis-Szabo <email@example.com> Status: It works 4 me! These match extensions (`hbh' and `dst') allow you to select the packet based on the fileds of the option header of the IPv6 packets. HBH options: --hbh-len [!] length total length of this header --hbh-opts TYPE[:LEN][,TYPE[:LEN]...] Options and its length (list, max: 16) DST options: --dst-len [!] length total length of this header --dst-opts TYPE[:LEN][,TYPE[:LEN]...] Options and its length (list, max: 16)
Author: Patrick <firstname.lastname@example.org> Status: Development: please tell me if and where I fucked up on the locks. This adds CONFIG_IP_NF_POOL, which provides a match which lets you use bitmaps with one bit per address from some range of IP addresses; the match depends on whether a checked source or destination address has its bit set in the pool. It also provides a POOL target, which can be used to add or remove the addresses of a packet to/from a pool. The userspace program ippool(8) is also compiled (in the ippool/ directory), and is used to define the pools and their bounds.
Author: Dennis Koslowski <email@example.com> Status: Experimental This option adds CONFIG_IP_NF_MATCH_PSD, which supplies portscan detection match (psd). This match will attempt to detect TCP and UDP port scans. This match was derived from Solar Designer's scanlogd. Suppported options are: --psd-weight-threshold
Total weight of the latest TCP/UDP packets with different destination ports coming from the same host to be treated as port scan sequence. --psd-delay-threshold Delay (in hundredths of second) for the packets with different destination ports coming from the same host to be treated as possible port scan subsequence. --psd-lo-ports-weight Weight of the packet with privileged (<=1024) destination port. --psd-hi-ports-weight Weight of the packet with non-priviliged destination port.
Author: Sam Johnston <firstname.lastname@example.org> Status: worksforme This option adds CONFIG_IP_NF_MATCH_QUOTA, which implements network quotas by decrementing a byte counter with each packet. Supported options are: --quota
The quota in bytes.
Author: Fabrice MARIE <email@example.com> Status: Works For Me. This option adds CONFIG_IP_NF_MATCH_RANDOM, which allow you to match packets randomly following a given probability. Suppported options are: [--average] percent will match randomly packets with a probability of 'percent' default is 50%
Author: Sampsa Ranta <firstname.lastname@example.org> Status: Experimental realm match: uses realm key from routing as match criteria similiar to one in packet classifier /** snip from packet classifier documentation */ Routing tables based classifier CONFIG_NET_CLS_ROUTE4 If you say Y here, you will be able to classify outgoing packets according to the route table entry they matched. If unsure, say Y. /** end snip **/ # Example # add route /sbin/ip route add 18.104.22.168/24 via 22.214.171.124 realm 10 # source realm is in realm with mask 0xFFFF0000, # destination is in realm with mask 0x0000FFFF # match destination realm /usr/local/sbin/iptables -A OUTPUT -m realm --realm 10 -j LOG # match realm of source, this is also determinated by routing, /usr/local/sbin/iptables -A INPUT -m realm --realm 655360 -j LOG THIS PATCH REQUIRES CONFIG_NET_CLS_ROUTE TO BE SET
Author: Andras Kis-Szabo <email@example.com> Status: It works 4 me! This match extension (`rt') allow you to select the packet based on the fileds of the routing header of the IPv6 packets. RT options: --rt-type [!] type match the type --rt-segsleft [!] num[:num] match the Segments Left field (range) --rt-len [!] length total length of this header --rt-0-res check the reserved filed, too (type 0) --rt-0-addrs ADDR[,ADDR...] Type=0 addresses (list, max: 16) --rt-0-not-strict List of Type=0 addresses not a strict list
Author: Fabrice MARIE <firstname.lastname@example.org> Status: It Works For Me. This option adds CONFIG_IP_NF_MATCH_TIME, which supplies a time match module. This match allows you to filter based on the packet arrival time (arrival time at the machine which the netfilter is running on) or departure time (for locally generated packets). Supported options are: --timestart HH:MM The starting point of the time match frame. --timestop HH:MM The stopping point of the time match frame --days Tue,Mon... Days of the week to match separated by a coma, no space (one of Sun,Mon,Tue,Wed,Thu,Fri,Sat) Example: -A INPUT -m time --timestart 8:00 --timestop 18:00 --days Mon,Tue,Wed,Thu,Fri will match packets that have an arrival timestamp in the range 8:00->18:00 from Monday to Friday. -A OUTPUT -m time --timestart 8:00 --timestop 18:00 --Days Mon will match the packets (locally generated) that have a departure timestamp in the range 8:00->18:00 on Monday only.
Generated Mon Jan 13 19:42:32 EST 2003 by pomlist version 0.2.2.