4 ms·
The article claims that the attack is particularly effective on (web) servers. Wouldn't this type of attack only affect connections that originate from the affe
by simon_acca 9y ago
The article claims that the attack is particularly effective on (web) servers.
Wouldn't this type of attack only affect connections that originate from the affected host though (and not the incoming ones)?
- burnbabyburn 9y agothe nat table affects packets originating from the host and ones that are forwarded
- simon_acca 9y agoExactly! So served HTTP requests wouldn't be affected.
- jstanley 9y agoBut the responses would be, I think.
- Godel_unicode 9y agoYou can absolutely NAT incoming packets using the NAT table. Put the rule into the PREROUTING chain and only change the port, not the dst IP. This trick is super useful for docker containers, and to allow unprivileged processes to listen on privileged ports.
- zAy0LfpBZLC8mAC 9y agoIt doesn't really make sense to talk about "incoming" packets at that point, as it is PREROUTING, so whether the destination address is local or not, and thus whether it's an incoming or a forwarded packet, has not been determined yet, and you can NAT however you like, local address to local address, local address to remote address, remote address to remote address, or remote address to local address.
- zAy0LfpBZLC8mAC 9y agoNo, why would it?