Individual Suite pages:
[summary] [combined] [base] [broken] [extra] [not-accepted] [obsolete] [oldnat] [pending] [submitted]extra depends on: submitted pending base
Patches which are working fine together + patches which might break each other
Author: Magnus Sandin <magnus@sandin.cx> Status: Development This adds CONFIG_IP_NF_EGG: Connection tracking for eggdrop bot networks. It now also supports eggdrop v1.6.x
Author: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> Status: Alpha This adds CONFIG_IP_NF_H323: H.323/netmeeting support module for netfilter connection tracking and NAT. H.323 uses/relies on the following data streams: Port Description 389 Internet Locator Server (TCP) 522 User Location Server (TCP) 1503 T.120 Protocol (TCP) 1720 H.323 (H.225 call setup, TCP) 1731 Audio call control (TCP) Dynamic H.245 call control (TCP) Dynamic RTCP/RTP streaming (UDP) The H.323 conntrack/NAT modules support the connection tracking/NATing of the data streams requested on the dynamic ports. The helpers use the search/replace hack from the ip_masq_h323.c module for the 2.2 kernel series. At the very minimum, H.323/netmeeting (video/audio) is functional by letting trough the 1720 port and loading these H.323 module(s). The H.323 conntrack/NAT modules do not support - H.245 tunnelling - H.225 RAS (gatekeepers)
Author: Martin Josefsson <gandalf@wlug.westbo.se> Status: Works for me(tm) This patch adds the ipt_helper module which is a new match for iptables. This adds the capability to match packets in a dynamically allocated connection that's related to a specific conntrack helper. If you want to match all packets belonging to ftp-sessions: (both ftp-command and ftp-data connections) iptables -A INPUT -m helper --helper ftp -j ACCEPT use irc for irc-sessions. It will currently only work with the ftp and irc conntrack-helpers but it's easy to add support for other helpers (a one-line patch to the conntrack-helper). You'll also need the bidirectional irc patch for irc matching to work properly. This patch modifies the way helpers are looked up when iptable_nat is loaded, the behaviour changes slightly, see comment in patch. Please report any breakage caused by this.
Author: Fabrice MARIE <fabrice@celestix.com>
Status: It Works For Me.
Adds the possibility to send icmp-unreachable messages
from a fake source IP address.
Example :
# iptables -A INPUT -p tcp -d 202.156.58.79 --dport http -j REJECT --fake-source 10.1.1.1
# iptables --list -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- 0.0.0.0/0 202.156.58.79 tcp dpt:80 reject-with icmp-port-unreachable faked from 10.1.1.1
***** WARNING ***** This patch also patch the userspace directory which means that you
you have to recompile and reinstall the iptables package after that.
Author: Fabrice MARIE <fabrice@celestix.com>
Status: Works For Me.
This patch adds support for matching the nfmark bitwise (and & or).
For example, to test if the second bit of nfmark is set :
# iptables -t mangle -A PREROUTING -p icmp -m mark --markand 0x2/0x2 -j ACCEPT
I'm sure you will find a use for the OR bitwise operation as well :)
# iptables -t mangle -A PREROUTING -p icmp -m mark --markor 0x7/0x1 -j ACCEPT
***** WARNING ***** This patch also patch the userspace directory which means that
you have to recompile and reinstall the iptables package after that.
Author: ... Status: Development This adds CONFIG_IP_NF_PPTP: Connection tracking and NAT support for PPTP.
Author: Stephen Frost <sfrost@snowman.net>
Status: Tested locally, no problems so far.
This module is used for creating one or many list(s) of recently seen IP
addresses and then matching against that/those list(s).
--name Specify the list to use for the commands. If no name is given
then 'DEFAULT' will be used.
--set followed by an optional `!'
This will add the source address of the packet to the list.
If the source address is already in the list, this will update
the existing entry. This will always return success.
--rcheck followed by an optional `!'
This will check if the source address of the packet is currently
in the list and return true if it is, and false otherwise.
--update followed by an optional `!'
This will check if the source address of the packet is currently
in the list. If it is then that entry will be updated and the
rule will return true. If the source address is not in the list
then the rule will return false.
--remove followed by an optional `!'
This will check if the source address of the packet is currently
in the list and if so that address will be removed from the list.
--seconds followed by an optional `!', then the value
This option must be used in conjunction with one of 'rcheck' or
'update'. When used, this will narrow the match to only happen
when the address is in the list and was seen within the last
given number of seconds.
--hitcount followed by an optional `!', then the value
This option must be used in conjunction with one of 'rcheck' or
'update'. When used, this will narrow the match to only happen
when the address is in the list and packets had been received
greater than or equal to the given value. This option may be
used along with 'seconds' to create an even narrower match
requiring a certain number of hits within a specific time frame.
--rttl This option must be used in conjunction with one of 'rcheck' or
'update'. When used, this will narrow the match to only happen
when the address is in the list and the TTL of the current packet
matches that of the packet which hit the --set rule. This may be
useful if you have problems with people faking their source
address in order to DoS you via this module by disallowing others
access to your site by sending bogus packets to you.
/proc/net/ipt_recent is a directory which contains the currently active lists.
/proc/net/ipt_recent/* are the current lists of addresses and information
about each entry of each list.
Each file in /proc/net/ipt_recent/ can be read from to see the current list
or written two using the following commands to modify the list:
'echo xx.xx.xx.xx > /proc/net/ipt_recent/DEFAULT' to Add to the DEFAULT list
or 'echo +xx.xx.xx.xx > /proc/net/ipt_recent/DEFAULT' for the same result.
'echo -xx.xx.xx.xx > /proc/net/ipt_recent/DEFAULT' to Remove from the DEFAULT list
'echo -0.0.0.0 > /proc/net/ipt_recent/DEFAULT' to empty the DEFAULT list.
The module itself accepts two parameters:
ip_list_tot=40
ip_pkt_list_tot=10
Shown are the defaults.
ip_list_tot is the total number of addresses which will be remembered, note
that the list is searched in-order for every attempted match and so you do
not want to increase this value too much or alot of time will be spent
traversing the list.
ip_pkt_list_tot is the total number of packets which will be remembered for
each address. This list is only used by '--hitcount' and so the default
will probably suffice unless you make extensive use of that option.
Example #1:
# iptables -A FORWARD -m recent --rcheck --seconds 60 -j DROP
# iptables -A FORWARD -i eth0 -d 127.0.0.0/8 -m recent --set -j DROP
Here we are making a 'bad guy' out of anyone who tries to send data to
127.0.0.0/8 on our eth0 interface (which should never legitimately
happen). The first packet will make it past the first rule and then
be caught by the second rule and that address will be put into the
recent list and the packet dropped.
Any subsequent packets for the next 60 seconds that show up from that
address will be dropped, regardless of destination address, destiation
port, etc.
Example #2:
# iptables -A FORWARD -m recent --update --seconds 60 -j DROP
# iptables -A FORWARD -i eth0 -d 127.0.0.0/8 -m recent --set -j DROP
(The author's favorite method)
This is identical to example #1 except that for every subsequent packet
received from this source address the 'last seen' status will be updated
in the table. Therefore there must be a 'quiet time' of 60 seconds
before another packet from this address will even be considered.
It is the author's intent that all 'DROP' rules be replaced by:
'-m recent --set -j DROP'
and that a:
'-m recent --update --seconds 60 -j DROP'
rule be added very early on in the rule set, though following any:
'--match state --state ! NEW,INVALID -j ACCEPT'
rules. If the '--update' rule is before this check for ! NEW,INVALID
packets then ESTABLISHED connection or those in the process of becoming
ESTABLISHED could be disrupted by a malicious person who can modify
his/her source address.
Author: "Marcelo Barbosa Lima" <marcelo.lima@dcc.unicamp.br> Status: This works now :-) Status: Ported to 2.4.0-test9-pre2 by Rusty. May be broken. Status: Fixed by Marc for 2.4.0. Status: Ported to newnat by Harald. May still be broken. This adds CONFIG_IP_NF_MATCH_RPC, which supplies two modules, ip_conntrack_rpc_udp and ip_conntrack_rpc_tcp, which track portmapper requests using UDP and TCP respectively. It also adds the record_rpc match for iptables, which matches if the source of the packet has requested that port through the portmapper before, or it is a new GET request to the portmapper, allowing effective RPC filtering.
Author: Emmanuel Roger <winfield@freegates.be> Status: Working, not with kernel 2.4.9 This patch adds CONFIG_IP_NF_MATCH_STRING which allows you to match a string in a whole packet. THIS PATCH DOES NOT WORK WITH KERNEL 2.4.9 !!!
Author: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Status: Alpha
This adds CONFIG_IP_NF_TALK: talk support module for netfilter
connection tracking and NAT. This allows both the callee client -
caller server and callee client - caller client connections to work
through connection tracking and NAT.
Default both talk (UDP port 517) and ntalk/ntalk2 (UDP port 518) are
supported. talk/ntalk/ntalk2 supports can selectively be enabled/disabled
by the module parameters of the ip_conntrack_talk and ip_nat_talk
modules:
talk=0|1
ntalk=0|1
ntalk2=0|1
where '0' means 'don't support' while '1' means 'do support'
the given protocol flavour.
Author: Jozsef Kadlecsik
Status: proven to be quite stable, but still experimental
Status: ported to newnat, needs testing.
This patch is an implementation of TCP connection tracking according
to the article 'Real Stateful TCP Packet Filtering in IP Filter' by
Guido van Rooij [1]. It contains the new TCP connection tracking with
support to handle already established connections. It supports TCP
window scaling.
[1] http://www.iae.nl/users/guido/papers/tcp_filtering.ps.gz
- the default timeout value for the CLOSE_WAIT state is raised to 12 hours
- sysctl support added (/proc/sys/net/ipv4/netfilter/), which means:
- all conntrack timeout values can be adjusted via sysctl
- logging of out of window packets and packets with invalid
window scale value can be disabled/enabled via sysctl
- a new flag ip_ct_tcp_be_liberal added: when ip_ct_tcp_be_liberal
is set to 0, all out of window packets are marked as INVALID,
while if it's set to 1, only out of window *RST* segments are
marked as INVALID.
- Beware!!! /proc/sys/net/ipv4/ip_conntrack_max is renamed as
/proc/sys/net/ipv4/netfilter/ip_conntrack_max. Update your scripts
which uses this parameter!!!
- logging of out of window packets are made more verbose
Author: Magnus Boden <mb@ozaba.mine.nu> TFTP connections will not work with NAT and this module makes that work. modprobe ip_conntrack_tftp ports=69,70 has the effect of helping tftp connections on port 69 and 70. If the ports argument is not supplied to modprobe it defaults to 69. If you have trouble please drop me a mail and I will help you.
Generated Thu May 9 13:18:19 EDT 2002 by pomlist version 0.2.2.