🚀 go-pugleaf

On Fri, 03 Jan 2003 16:32:23 +0000, John Armstrong
<ja@ggrove.swinternet.co.uk> wrote:

Hi John,
thanks for your response

[snip again]
>
>Assuming bind is being used, has /etc/named.conf been altered? My copy
>has the following comment:
>         * Previous versions of BIND always asked
>         * questions using port 53, but BIND 8.1 uses an unprivileged
>         * port by default.
>         */
>        // query-source address * port 53;
>
it's not Bind, it's M$ ;-( (ssstt, don't tell anyone) 
but it's ok for me that (on the local network) it acts as a dns-server
and therefor sents its requests to other dns-servers FROM (and to)
port 53.

>>
>>IN SHORT : 
>>Why doesn't the MASQ-module of iptables translate the portnumber when
>>it's MASQ'ing (and ipchains did !) ??
>man iptables :
> --to-ports port[-port]
>  This  specifies  a  range of source ports to use, overriding the
>  default SNAT source port-selection heuristics (see above).  This
>  is only valid if the rule also specifies -p tcp or -p udp.
I think this one is more used for redirection. eg: incomming packets
on port 8000 on external interface of router should be redirected to
other internal machine on port 80 (then the --to-ports 80 should be
used). As described in 6.2.1 of the NAT-howto.

>>First I thought it wasn't doing this for DNS-request only, but taking
>>a closer look, it doesn't do this for any service.
>>So if two computers in my LAN start an http-request from their local
>>port 1026, my linux-router/firewall will sent them both out with the
>>same source-port.  I'm wondering what kind of effect this wil have !
>Not an expert, but presumably the de-masq'ing process sorts it out and
>sends the reply packets back where they should go. Not sure how it
>would work if both requests were going the the same destination
>though.

I thought it would give each outgoing packet a new unique source-port
(let's say: starting from 61000). When the packets come back, it can
check this port, look it up in it's NAT-table, and forward the packet
to the original requester. As far as I know, this is how ipchains
worked.
Now it seems that iptables is doing it different, Or I did something
wrong with my configuration, Or I'm using a buggy version of iptables.

K.