Mangling packet headers - Revision history

Pablo: /* Mangling TCP options */ remove oifname pppoe0, see note regarding mangling TCP MSS option

2021-05-03T21:27:30Z

Mangling TCP options: remove oifname pppoe0, see note regarding mangling TCP MSS option

← Older revision		Revision as of 21:27, 3 May 2021
Line 31:		Line 31:

	<source lang="bash">		<source lang="bash">
	nft add rule ip filter forward ~~oifname ppp0~~ tcp flags syn tcp option maxseg size set 1452		nft add rule ip filter forward tcp flags syn tcp option maxseg size set 1452
	</source>		</source>

Pablo: /* Mangling TCP options */ fix example rule regarding TCP MSS mangling

2021-05-03T21:26:20Z

Mangling TCP options: fix example rule regarding TCP MSS mangling

← Older revision		Revision as of 21:26, 3 May 2021
Line 19:		Line 19:

	<source lang="bash">		<source lang="bash">
	nft add rule ip filter forward ~~oifname ppp0~~ tcp flags syn tcp option maxseg size set rt mtu		nft add rule ip filter forward tcp flags syn tcp option maxseg size set rt mtu
	</source>		</source>

	where '''rt mtu''' calculates the MTU in runtime based on what the routing cache has observed via Path MTU Discovery (PMTUD).		where '''rt mtu''' calculates the MTU in runtime based on what the routing cache has observed via Path MTU Discovery (PMTUD).

			Note: The TCP maximum segment size is announced through TCP options in the original syn and the reply syn+ack packets. TCP maximum segment size is not negotiated, the RFC specifies that it is possible to have different TCP maximum segment size in each direction of the flow. Therefore, make sure you mangle both the TCP options of the original syn and the reply syn+ack packets.

	Note for iptables users: 'tcp option maxseg size set rt mtu' is equivalent to '-j TCPMSS --clamp-mss-to-pmtu'.		Note for iptables users: 'tcp option maxseg size set rt mtu' is equivalent to '-j TCPMSS --clamp-mss-to-pmtu'.
Line 33:		Line 35:

	Other supported TCP options are: window, sack-permitted, sack, timestamp and eol.		Other supported TCP options are: window, sack-permitted, sack, timestamp and eol.


	== Interactions with conntrack ==		== Interactions with conntrack ==

Fmyhr: Copied (and slightly renamed) mangling TCP options from separate page to section here.

2021-04-16T21:20:11Z

Copied (and slightly renamed) mangling TCP options from separate page to section here.

@@ Line 13: / Line 13: @@
 The commands above create a table named ''raw'', a chain named ''prerouting'', see [[Netfilter hooks]], and a rule to mangle the destination port of packets over TCP from 8080 to 80.
 = Interactions with conntrack =
 Keep in mind the interactions with conntrack, flows with mangled traffic must be [[Setting packet connection tracking metainformation | untracked]]. You can do this in a single rule:

Fmyhr: Fmyhr moved page Mangle packet header fields to Mangling packet headers: Remove redundancy in and shorten title. Updating links immediately after.

2021-04-16T20:50:30Z

Fmyhr moved page Mangle packet header fields to Mangling packet headers: Remove redundancy in and shorten title. Updating links immediately after.

← Older revision		Revision as of 20:50, 16 April 2021
(No difference)

Fmyhr: /* Interactions with conntrack */ Updated link to matching packet headers.

2021-04-16T20:34:13Z

Interactions with conntrack: Updated link to matching packet headers.

← Older revision		Revision as of 20:34, 16 April 2021
Line 21:		Line 21:
	</source>		</source>

	For more information about packet headers to mangle check manpage nft(8), [[Matching packet ~~header fields~~]] and [[Quick reference-nftables in 10 minutes]].		For more information about packet headers to mangle check manpage nft(8), [[Matching packet headers]] and [[Quick reference-nftables in 10 minutes]].

Pablo at 18:05, 18 December 2020

2020-12-18T18:05:29Z

← Older revision		Revision as of 18:05, 18 December 2020
Line 1:		Line 1:
	Since nft v0.6 nftables supports stateless ~~payload mangling~~. Note ~~that~~ if you mangle packet fields that are included in the [https://en.wikipedia.org/wiki/User_Datagram_Protocol#IPv4_Pseudo_Header layer 4 checksum pseudoheader], then you require a Linux kernel version >= 4.10.		Since nft v0.6 nftables supports packet header mangling, including stateless NAT.

			'''Note''': if you mangle packet fields that are included in the [https://en.wikipedia.org/wiki/User_Datagram_Protocol#IPv4_Pseudo_Header layer 4 checksum pseudoheader], then you require a Linux kernel version >= 4.10.

	To mangle packet header fields you should create a rule to match the packet, match the desired header field and set a new value to it:		To mangle packet header fields you should create a rule to match the packet, match the desired header field and set a new value to it:
Line 10:		Line 12:

	The commands above create a table named ''raw'', a chain named ''prerouting'', see [[Netfilter hooks]], and a rule to mangle the destination port of packets over TCP from 8080 to 80.		The commands above create a table named ''raw'', a chain named ''prerouting'', see [[Netfilter hooks]], and a rule to mangle the destination port of packets over TCP from 8080 to 80.

			= Interactions with conntrack =

	Keep in mind the interactions with conntrack, flows with mangled traffic must be [[Setting packet connection tracking metainformation \| untracked]]. You can do this in a single rule:		Keep in mind the interactions with conntrack, flows with mangled traffic must be [[Setting packet connection tracking metainformation \| untracked]]. You can do this in a single rule:

Arturo: delete redundant header

2018-01-11T10:14:28Z

delete redundant header

← Older revision		Revision as of 10:14, 11 January 2018
Line 1:		Line 1:
	~~== Mangle packet header fields ==~~

	Since nft v0.6 nftables supports stateless payload mangling. Note that if you mangle packet fields that are included in the [https://en.wikipedia.org/wiki/User_Datagram_Protocol#IPv4_Pseudo_Header layer 4 checksum pseudoheader], then you require a Linux kernel version >= 4.10.		Since nft v0.6 nftables supports stateless payload mangling. Note that if you mangle packet fields that are included in the [https://en.wikipedia.org/wiki/User_Datagram_Protocol#IPv4_Pseudo_Header layer 4 checksum pseudoheader], then you require a Linux kernel version >= 4.10.

Arturo: use raw/prerouting rather than mangle/forward

2018-01-11T10:08:11Z

use raw/prerouting rather than mangle/forward

← Older revision		Revision as of 10:08, 11 January 2018
Line 6:		Line 6:

	<source lang="bash">		<source lang="bash">
	% nft add table ~~mangle~~		% nft add table raw
	% nft add chain ~~mangle forward~~ {type filter hook ~~forward~~ priority 0\;}		% nft add chain raw prerouting {type filter hook prerouting priority -300\;}
	% nft add rule ~~mangle forward~~ tcp dport 8080 tcp dport set 80		% nft add rule raw prerouting tcp dport 8080 tcp dport set 80
	</source>		</source>

	The commands above create a table named ''~~mangle~~'', a chain named ''~~forward~~'', see [[Netfilter hooks]], and a rule to mangle the destination port of packets over TCP from 8080 to 80.		The commands above create a table named ''raw'', a chain named ''prerouting'', see [[Netfilter hooks]], and a rule to mangle the destination port of packets over TCP from 8080 to 80.

	Keep in mind the interactions with conntrack, flows with mangled traffic must be [[Setting packet connection tracking metainformation \| untracked]]. You can do this in a single rule:		Keep in mind the interactions with conntrack, flows with mangled traffic must be [[Setting packet connection tracking metainformation \| untracked]]. You can do this in a single rule:

	<source>		<source>
	% nft add rule ip6 ~~mangle forward~~ ip6 daddr fd00::1 ip6 daddr set fd00::2 notrack		% nft add rule ip6 raw prerouting ip6 daddr fd00::1 ip6 daddr set fd00::2 notrack
	</source>		</source>

	For more information about packet headers to mangle check manpage nft(8), [[Matching packet header fields]] and [[Quick reference-nftables in 10 minutes]].		For more information about packet headers to mangle check manpage nft(8), [[Matching packet header fields]] and [[Quick reference-nftables in 10 minutes]].

Arturo: add example of using notrack, along with a reference to the article.

2017-09-13T11:14:32Z

add example of using notrack, along with a reference to the article.

← Older revision		Revision as of 11:14, 13 September 2017
Line 11:		Line 11:
	</source>		</source>

	The commands above create a table named ''mangle'', a chain named ''forward'', see [[Netfilter hooks]], and a rule to mangle the destination port of packets over TCP from 8080 to 80. Keep in mind the interactions with conntrack, flows with mangled traffic must be untracked.		The commands above create a table named ''mangle'', a chain named ''forward'', see [[Netfilter hooks]], and a rule to mangle the destination port of packets over TCP from 8080 to 80.

			Keep in mind the interactions with conntrack, flows with mangled traffic must be [[Setting packet connection tracking metainformation \| untracked]]. You can do this in a single rule:

			<source>
			% nft add rule ip6 mangle forward ip6 daddr fd00::1 ip6 daddr set fd00::2 notrack
			</source>

	For more information about packet headers to mangle check manpage nft(8), [[Matching packet header fields]] and [[Quick reference-nftables in 10 minutes]].		For more information about packet headers to mangle check manpage nft(8), [[Matching packet header fields]] and [[Quick reference-nftables in 10 minutes]].

Admin: kernel version requirement

2017-09-13T10:09:47Z

kernel version requirement

← Older revision		Revision as of 10:09, 13 September 2017
Line 1:		Line 1:
	== Mangle packet header fields ==		== Mangle packet header fields ==

	Since nft v0.6 nftables supports stateless payload mangling.		Since nft v0.6 nftables supports stateless payload mangling. Note that if you mangle packet fields that are included in the [https://en.wikipedia.org/wiki/User_Datagram_Protocol#IPv4_Pseudo_Header layer 4 checksum pseudoheader], then you require a Linux kernel version >= 4.10.

	To mangle packet header fields you should create a rule to match the packet, match the desired header field and set a new value to it:		To mangle packet header fields you should create a rule to match the packet, match the desired header field and set a new value to it: