Discussion:
why scapy packet no effected by ip tables
Abogholo A
2014-07-16 12:46:21 UTC
Permalink
HI


i wrote this rule for change all udp destination ip address to 8.8.8.8
when dport is 53:

iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT
--to-destination 8.8.8.8

but when send this packet

sr1(IP(dst="4.2.2.4")/UDP()/DNS(rd=1,qd=DNSQR(qname="iranled.com")))

iptables no effected to them

why?

more details:

http://unix.stackexchange.com/questions/144729/iptables-rule-no-actions-on-scapy-packets
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Phil Oester
2014-07-17 15:23:50 UTC
Permalink
Post by Abogholo A
i wrote this rule for change all udp destination ip address to 8.8.8.8
iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT
--to-destination 8.8.8.8
but when send this packet
sr1(IP(dst="4.2.2.4")/UDP()/DNS(rd=1,qd=DNSQR(qname="iranled.com")))
iptables no effected to them
why?
Scapy uses raw sockets, which don't go through iptables.

Phil
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Paul Robert Marino
2014-07-20 16:27:55 UTC
Permalink
look at ebtables instead.
Post by Phil Oester
Post by Abogholo A
i wrote this rule for change all udp destination ip address to 8.8.8.8
iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT
--to-destination 8.8.8.8
but when send this packet
sr1(IP(dst="4.2.2.4")/UDP()/DNS(rd=1,qd=DNSQR(qname="iranled.com")))
iptables no effected to them
why?
Scapy uses raw sockets, which don't go through iptables.
Phil
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Jeff White
2014-07-21 12:38:26 UTC
Permalink
Obviously you are doing this for DNS, you need TCP too. If a DNS
request or response is larger than 512 bytes it will use TCP.

Jeff White - GNU+Linux Systems Administrator
University of Pittsburgh - CSSD
Post by Paul Robert Marino
look at ebtables instead.
Post by Phil Oester
Post by Abogholo A
i wrote this rule for change all udp destination ip address to 8.8.8.8
iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT
--to-destination 8.8.8.8
but when send this packet
sr1(IP(dst="4.2.2.4")/UDP()/DNS(rd=1,qd=DNSQR(qname="iranled.com")))
iptables no effected to them
why?
Scapy uses raw sockets, which don't go through iptables.
Phil
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Loading...