Automatic forwarding to own interfaces

Automatic forwarding to own interfaces

[Simon Lodal]

Hello

I am seeing strange behaviour, wonder if anyone can confirm this, or else tell me that I have completely screwed my boxes.

My Linux box seems to automatically forward between it's own interfaces, effectively treating them all as one. Traffic coming in on one interface, destined for another interface, should in my mind pass through the FORWARD chain. Instead, it goes through INPUT/OUTPUT. Effectively then any local address can be accessed on any local interface.


Details:

The "victim" box is a Debian-3.0r1 with the default 2.4.18-bf2.4 kernel and iptables-1.2.6a. My other boxes with other 2.4.1[89] kernels behave the same.

Victim has two interfaces, eth0 (10.0.1.2/24) and eth1 (192.168.1.5/24).

Victim's /proc config:
/proc/sys/net/ipv4/ip_forward=0
/proc/sys/net/ipv4/rp_filter=1
/proc/sys/net/ipv4/conf/*/accept_source_route=0

Another host "evil" is on the 10.0.1.0/24 subnet, and has no way to reach the 192.168.1.0/24 subnet. It then configures itself to use victim as gateway to the 192.168.1.0/24 subnet. But since victim has disabled all forwarding, evil can still not reach any 192.168.1.0/24 hosts. Except...

The strange thing is that when evil does 'ping 192.168.1.5' it succeeds. It pings victim's eth1 through eth0.

The really strange thing is that victim does not treat the traffic as forwarding, but as locally destined traffic, going through INPUT and OUTPUT chains.

Log rules in INPUT, FORWARD and OUTPUT chains on victim show that a ping packet with dest=192.168.1.5 comes in through eth0, and a pong packet with src=192.168.1.5 is sent back through eth0. Packets go through INPUT and OUTPUT chains, not FORWARD. Effectively, it is as if eth0 was configured with 192.168.1.5.

Now ping is handled by kernel, so I tried with userspace, and got same result: An apache listening only on 192.168.1.5:80 will happily respond to requests from the 10.0.1.0/24 subnet, coming in on eth0.

Is all this really intentional? It makes no sense to me. Can anyone confirm this behaviour?

Simon

Re: Automatic forwarding to own interfaces

[Cedric Blancher]

Le mar 23/09/2003 à 07:14, Simon Lodal a écrit :
> Another host "evil" is on the 10.0.1.0/24 subnet, and has no way to
> reach the 192.168.1.0/24 subnet. It then configures itself to use
> victim as gateway to the 192.168.1.0/24 subnet. But since victim has
> disabled all forwarding, evil can still not reach any 192.168.1.0/24
> hosts. Except...
> The strange thing is that when evil does 'ping 192.168.1.5' it
> succeeds. It pings victim's eth1 through eth0.

That's a "normal" Linux behaviour. Linux answers packets destined to any
of its own IPs own any interface, as long as your INPUT filtering rules
allows it. You can set something like :

	iptables -A INPUT -d 192.168.1.5 -i ! eth1 -j DROP
	iptables -A OUTPUT -s 192.168.1.5 -o ! eth1 -j DROP

> The really strange thing is that victim does not treat the traffic as
> forwarding, but as locally destined traffic, going through INPUT and
> OUTPUT chains.

Yes, for the packets are destined to the box itself, they don't get
routed.

> Is all this really intentional? It makes no sense to me. Can anyone
> confirm this behaviour?

You can even see that eth0 will answer ARP requests on eth1's IP...
That's one of the reasons for arptables. There was a patch to change
this behaviour too.

A behaviour a bit like this one is when you set DNAT up (rules are quick
ones) :

	iptables -t nat -A PREROUTING -i eth0 -d 10.0.1.2 -j DNAT \
		--to 192.168.1.10
	iptables -A FORWARD -i eth0 -o eth1 -d 192.168.1.10 -j ACCEPT
	iptables -A FORWARD -i eth1 -o eth0 -s 192.168.1.10 -j ACCEPT

A box on 10.0.1.2/24 will be able to reach 192.168.1.10 directly, as
long as it defines your box as router for this destination, for the
FORWARD rules allows it.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE

Re: Automatic forwarding to own interfaces

[Simon Lodal]

>That's a "normal" Linux behaviour. Linux answers packets destined to any
>of its own IPs own any interface, as long as your INPUT filtering rules
>allows it. You can set something like :
>
>	iptables -A INPUT -d 192.168.1.5 -i ! eth1 -j DROP
>	iptables -A OUTPUT -s 192.168.1.5 -o ! eth1 -j DROP

Hmm... I was afraid this was the case.

So in the common small scale setup with one box acting as router, firewall and internal web and smtp server, this is an absolute must. Or your "internal" web and smtp services will in fact be open to anyone.

So what is the point in configuring daemons to listen only on specific addresses?

This is probably a surprise to some, as it is to me. Quite a few firewall packages and setups miss this point.

Simon

Re: Automatic forwarding to own interfaces

[Martin Josefsson]

On Tue, 23 Sep 2003, Simon Lodal wrote:

> >That's a "normal" Linux behaviour. Linux answers packets destined to any
> >of its own IPs own any interface, as long as your INPUT filtering rules
> >allows it. You can set something like :
> >
> >	iptables -A INPUT -d 192.168.1.5 -i ! eth1 -j DROP
> >	iptables -A OUTPUT -s 192.168.1.5 -o ! eth1 -j DROP
>
> Hmm... I was afraid this was the case.
>
> So in the common small scale setup with one box acting as router, firewall and internal web and smtp server, this is an absolute must. Or your "internal" web and smtp services will in fact be open to anyone.
>
> So what is the point in configuring daemons to listen only on specific addresses?
>
> This is probably a surprise to some, as it is to me. Quite a few firewall packages and setups miss this point.

Usually you don't even care about to which ip on the local machine someone
connects, only the sourceip/interface they are connecting from. So just
take out the -d part in INPUT rules.

/Martin

Re: Automatic forwarding to own interfaces

[Nik Trevallyn-Jones]

On Tue, 23 Sep 2003 23:14, you wrote:
> Subject: Re: Automatic forwarding to own interfaces
>
> >That's a "normal" Linux behaviour. Linux answers packets destined to any
> >of its own IPs own any interface, as long as your INPUT filtering rules
> >allows it. You can set something like :
> >
> >	iptables -A INPUT -d 192.168.1.5 -i ! eth1 -j DROP
> >	iptables -A OUTPUT -s 192.168.1.5 -o ! eth1 -j DROP
>
> Hmm... I was afraid this was the case.
>
> So in the common small scale setup with one box acting as router, firewall
> and internal web and smtp server, this is an absolute must. Or your
> "internal" web and smtp services will in fact be open to anyone.

Well, as far as I can tell, it's not *quite* that bad. For anyone to get this 
behaviour, they would have to define your external address as their gateway, 
and then address their packets correctly to your internal interface 
address(es). I don't know enough about IP routing to know if they could do 
this assuming that the machine they are sending from probably already has a 
gateway configured to enable their packet to get *out* from their network in 
the first place.

> So what is the point in configuring daemons to listen only on specific
> addresses?

I use this to implement virtual servers.

> This is probably a surprise to some, as it is to me. Quite a few firewall
> packages and setups miss this point.

It is a big surprise to me. The firewall setup that I originally copied, and 
have happily enhanced over time already had rules to DROP packets that 
didn't belong on a particular interface, with comments such as "stuffed 
routing", "spoofed address", etc, so I already had this protection, although 
I was unaware of the issue.

Cheers!
Nik