Results 1 to 5 of 5

Thread: post-firewall port triggering

  1. #1

    post-firewall port triggering

    Question: How do you use port triggering in post-firewall?

    I know I'm answering my own question but I thought some people may be curious. I got the information by experimenting with iptables. After enabling port triggering, I noticed the following entry when I typed iptables -L -v -t nat:
    Code:
        0     0 autofw     tcp  --  br0    any     anywhere             anywhere           tcp dpt:6881 autofw tcp dpt:6881-6999 to:6881-6999
    Answer:
    iptables -t nat -A PREROUTING -i br0 -p INCOMING_PROTOCOL --dport TRIGGER_PORT_FROM(-TRIGGER_PORT_TO) -j autofw --related-proto TRIGGER_PROTOCOL --related-dport INCOMING_PORT_FROM(-INCOMING_PORT_TO) --related-to INCOMING_PORT_FROM(-INCOMING_PORT_TO)

    For example, to set up a trigger for BitTorrent, you'd use this:
    iptables -t nat -A PREROUTING -i br0 -p tcp --dport 6881 -j autofw --related-proto tcp --related-dport 6881-6999 --related-to 6881-6999
    Last edited by tomilius; 28-02-2005 at 01:54. Reason: Cosmetic

  2. #2
    Join Date
    Apr 2004
    Location
    Netherlands
    Posts
    1,307
    Shouldn't you use port forwarding for BitTorrent instead?

  3. #3
    Eh. Probably. Random example--some site said it was better to use port triggering for multiple computer support, plus it was more secure or something.

    Quote Originally Posted by http://p2p.weblogsinc.com/entry/0401842428674831/ George Hotelling
    Port Triggering

    Excellent guide, this is something that more people need to be aware of. However I do have one suggestion.

    This only works if you only have one computer behind your router downloading BitTorrents. A better way would be to turn on Port Triggering (in Advanced?) telling it to forward the ports you list above with the trigger port set to 6881 and the protocol to TCP.

    When this is set up you don't need to know the internal IP of your computer, because the router will forward BitTorrent traffic to whatever system is running BitTorrent at the time. It knows which computer to use because BitTorrent will send traffic out on port 6881, the router sees this and starts forwarding traffic to your computer.

  4. #4
    Join Date
    Apr 2004
    Location
    Netherlands
    Posts
    1,307
    Quote Originally Posted by tomilius
    Eh. Probably. Random example--some site said it was better to use port triggering for multiple computer support, plus it was more secure or something.
    In case of multiple computers that is true...

  5. #5
    Quote Originally Posted by tomilius View Post
    Question: How do you use port triggering in post-firewall?

    I know I'm answering my own question but I thought some people may be curious. I got the information by experimenting with iptables. After enabling port triggering, I noticed the following entry when I typed iptables -L -v -t nat:
    Code:
        0     0 autofw     tcp  --  br0    any     anywhere             anywhere           tcp dpt:6881 autofw tcp dpt:6881-6999 to:6881-6999
    Answer:
    iptables -t nat -A PREROUTING -i br0 -p INCOMING_PROTOCOL --dport TRIGGER_PORT_FROM(-TRIGGER_PORT_TO) -j autofw --related-proto TRIGGER_PROTOCOL --related-dport INCOMING_PORT_FROM(-INCOMING_PORT_TO) --related-to INCOMING_PORT_FROM(-INCOMING_PORT_TO)

    For example, to set up a trigger for BitTorrent, you'd use this:
    iptables -t nat -A PREROUTING -i br0 -p tcp --dport 6881 -j autofw --related-proto tcp --related-dport 6881-6999 --related-to 6881-6999
    I do realize this thread is a few years ago but I wanted to update it since it was the most helpful information that I got. It relates to port triggering and I wanted to do it via the post-firewall script while doing ranges. Here is a new updated commandline format.

    iptables -t nat -A PREROUTING -i br0 -p INCOMING_PROTOCOL --dport TRIGGER_PORT_FROM(:TRIGGER_PORT_TO) -j autofw --related-proto TRIGGER_PROTOCOL --related-dport INCOMING_PORT_FROM(:INCOMING_PORT_TO) --related-to INCOMING_PORT_FROM(:INCOMING_PORT_TO)

    The only real change is replacing the hyphen ( - ) with a colon ( : ) to indicate a range. Here is an example which is the actual line I inserted into my post-firewall file. It is for forwarding ident port 113 as needed when connecting to irc rooms.

    iptables -t nat -A PREROUTING -i br0 -p tcp --dport 6660:6669 -j autofw --related-proto tcp --related-dport 113 --related-to 113

    I did not figure out how to get multiple ports in there without doing ranges. Online documentation indicates to use -m multiport right before the first --dport however I got a file not found error from iptables when I tried to do that. Oh well. I'll research it some more when I get a chance. In the meantime it works good. I added port 7000 as a seperate entry.

Similar Threads

  1. Start own script in post-boot or post-firewall
    By m-h-l in forum WL-500g Q&A
    Replies: 2
    Last Post: 30-09-2005, 20:03
  2. post-firewall script is not being executed
    By Fama in forum WL-500g Q&A
    Replies: 6
    Last Post: 09-08-2005, 10:14
  3. Wondershaper in Post-Firewall
    By britnet in forum WL-500g Q&A
    Replies: 3
    Last Post: 05-03-2005, 13:46
  4. When is post-firewall called?
    By barsju in forum WL-500g Q&A
    Replies: 1
    Last Post: 28-01-2005, 17:50
  5. Replies: 3
    Last Post: 24-12-2004, 20:13

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •