I want to make a decision of what computer is behind the firewall sending the packet.

Imagine I have 2 PCs behind the firewall and I want to, based on (my algorithm), make a decision at the firewall level, before doing the NAT. Basically intercept the packet, then make the decision, how can I do that?

What tool should I use to write my custom C code to perform that operation.


It's unclear if you want to actually act on the data in the packet or just route it based on which computer sent it?

iptables can do the routing, and it's pretty sophisticated. It makes use of what are called "tables", ironically, and so you can interrogate and re-route the data as it passes through the various "tables".

See this tutorial for more info: http://wiki.centos.org/HowTos/Network/IPTables.

There are 3 primary tables but more can be added via plugins/modules and also custom ones can be developed too.

The primary ones:

  • Input
  • Forward
  • Output

So as a packet comes into the box it would pass through the "Input" table where it can be acted on. As packets flow out of the box they flow through the "Output" table and can be acted on their as well.

Take a look at this tutorial for more info on iptables.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.