In this sections, we will show the available connection tracking/nat patches. To use them, simply load the corresponding modules (with options if needed) for them to be in effect.
This patch by Brian J. Murrell <netfilter@interlinx.bc.ca> adds support for connection tracking and nat of the Amanda backup tool protocol.
This patch by Magnus Sandin <magnus@sandin.cx> adds support for connection tracking for eggdrop bot networks.
This patch by Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> adds H.323/netmeeting support module for netfilter connection tracking and NAT.
H.323 uses/relies on the following data streams :
The H.323 conntrack/NAT modules support the connection tracking/NATing of the data streams requested on the dynamic ports. The helpers use the search/replace hack from the ip_masq_h323.c module for the 2.2 kernel series.
At the very minimum, H.323/netmeeting (video/audio) is functional by letting trough the 1720 port and loading these H.323 module(s).
The H.323 conntrack/NAT modules do not support :
This patch by Harald Welte <laforge@gnumonks.org> allows DCC to work though NAT and connection tracking. By default, this module will track IRC connection on port 6667. But you can change this for another port with the `ports=xx' argument.
This patch by Filip Sneppe <filip.sneppe@cronos.be> adds support for connection tracking of Microsoft Streaming Media Services protocol.
This allows client (Windows Media Player) and server to negotiate protocol (UDP, TCP) and port for the media stream. A partially reverse engineered protocol analysis is available from here, together with a link to a Linux client.
It is recommended to open UDP port 1755 to the server, as this port is used for retransmission requests.
This helper has been tested in SNAT and DNAT setups.
This patch by Harald Welte <laforge@gnumonks.org> allows netfilter to track pptp connection as well as to NAT them.
This patch by Filip Sneppe <filip.sneppe@cronos.be> adds support for Quake III Arena connection tracking and nat.
This patch by Ian Larry Latter <Ian.Latter@mq.edu.au> adds support for RSH connection tracking.
An RSH connection tracker is required if the dynamic stderr "Server to Client" connection is to occur during a normal RSH session. This typically operates as follows :
Client 0:1023 --> Server 514 (stream 1 - stdin/stdout)
Client 0:1023 <-- Server 0:1023 (stream 2 - stderr)
The author of this patch is warning you that this module could be dangerous, and that it is not "best practice" to use RSH, and you should use SSH in all instances.
This patch by James Morris <jmorris@intercode.com.au> allows netfilter to NAT basic SNMP This is the ``basic'' form of SNMP-ALG, as described in RFC 2962, it works by modifying IP addresses inside SNMP payloads to match IP-layer NAT mapping.
This patch by Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> allows netfilter to track talk connections, as well as to NAT them. By default both otalk (UDP port 517) and talk (UDP port 518) are supported. otalk/talk supports can selectively be enabled/disabled by the module parameters of the ip_conntrack_talk and ip_nat_talk modules. The options are :
where `0' means `do not support' while `1' means `do support' the given protocol flavor.
This patch by Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> allows netfilter do TCP connection tracking according to the article Real Stateful TCP Packet Filtering in IP Filter by Guido van Rooij. It supports window scaling, and can now handle already established connections.
This patch by Magnus Boden <mb@ozaba.mine.nu> allows netfilter to track tftp connections as well as to NAT them. By default, this module will track tftp connections on port 69. But you can change this for another port with the `ports=xx' argument.