Re:Abusing Linux's firewall: the hack that allowed us to bui...
by majke on Friday April 13, 2018 @05:45AM
(#16828388)
Indeed! Conceptually REDIRECT is _very_ similar to TPROXY. The subtle difference is that REDIRECT seems to rewrite the destination-host-and-port while TPROXY keeps it the same, only does the routing earlier.
In practical terms to recover original target in REDIRECT you have to use the obscure SO_ORIGINAL_DST, while for TPROXY getpeername() will just work.
By this token TPROXY is a bit easier to use. This is for TCP. UDP is a bit harder.
In practical terms to recover original target in REDIRECT you have to use the obscure SO_ORIGINAL_DST, while for TPROXY getpeername() will just work.
By this token TPROXY is a bit easier to use. This is for TCP. UDP is a bit harder.