Throttling by 'limit' in one chain fails whenever a *different* chain is modified

Throttling by 'limit' in one chain fails whenever a *different* chain is modified

[Paul Kosinski]

[Posting this to the general list got no response since Dec 15, so I'll try the developer list.]

Hi,

I have set up a moderately complicated firewall which has (among other things) two dynamic chains whose rules are changed several times per hour. The rule changing is done by first flushing the chain and then adding the new rules. Let's call these two chains DYNAMIC1 and DYNAMIC2, so the script reads thus (details of rules omitted):

  iptables -F DYNAMIC1
  iptables -F DYNAMIC2

  if [proper time of hour]; then
    iptables -A DYNAMIC1 [allow some packets]
    iptables -A DYNAMIC2 [allow other packets]
  fi

In another section of the firewall, I have the following chain whose purpose is to log very occasionally some continually arriving tunnel packets (just to see when the tunnel is active).

  iptables -A TUNLOG                                 \
           -m state --state ESTABLISHED              \
           -m limit --limit 1/hour --limit-burst 1   \
           -j LOG --log-prefix "iptables: Tun ...  "

  iptables -A TUNLOG                                 \
           -m state --state NEW                      \
           -m limit --limit 1/minute --limit-burst 1 \
           -j LOG --log-prefix "iptables: Tun-New  "
  
  iptables -A TUNLOG                                 \
           -m state --state RELATED                  \
           -m limit --limit 1/minute --limit-burst 1 \
           -j LOG --log-prefix "iptables: Tun-Rel  "
  
  iptables -A TUNLOG                                 \
           -m state --state INVALID                  \
           -m limit --limit 1/minute --limit-burst 1 \
           -j LOG --log-prefix "iptables: Tun-Bad  "
  
  iptables -A TUNLOG                                 \
           -j ACCEPT

The problem I experience is that whenever the dynamic-rule script fires, I get a log entry for an established-tunnel packet. Since the first script fires N times per hour, I get N times as many log entries for the tunnel as I want. This makes my examination of the firewall log more tedious and error prone than it should be.

This seems to me to be a bug in iptables/netfilter. I am using iptables 1.2.11 and kernel 2.4.28 with the ebtables patch 'ebtables-brnf-8_vs_2_4_28_diff'.

Paul Kosinski

Re: Throttling by 'limit' in one chain fails whenever a *different* chain is modified

[Phil Oester]

On Tue, Dec 28, 2004 at 12:44:34PM -0500, Paul Kosinski wrote:
> [Posting this to the general list got no response since Dec 15, so I'll try the developer list.]

Did you search the archives prior to posting?  That is generally
considered to be a good idea (as is wrapping lines at 80 characters).

> The problem I experience is that whenever the dynamic-rule script fires, I get a log entry for an established-tunnel packet. Since the first script fires N times per hour, I get N times as many log entries for the tunnel as I want. This makes my examination of the firewall log more tedious and error prone than it should be.

Please see this thread:

https://lists.netfilter.org/pipermail/netfilter-devel/2004-September/016826.html

Phil

Throttling by 'limit' in one chain fails whenever a *different* chain is modified

[Paul Kosinski]

Hi,

I have set up a moderately complicated firewall which has (among other things) two dynamic chains whose rules are changed several times per hour. The rule changing is done by first flushing the chain and then adding the new rules. Let's call these two chains DYNAMIC1 and DYNAMIC2, so the script reads thus (details of rules omitted):

  iptables -F DYNAMIC1
  iptables -F DYNAMIC2

  if [proper time of hour]; then
    iptables -A DYNAMIC1 [allow some packets]
    iptables -A DYNAMIC2 [allow other packets]
  fi

In another section of the firewall, I have the following chain whose purpose is to log very occasionally some continually arriving tunnel packets (just to see when the tunnel is active).

  iptables -A TUNLOG                                 \
           -m state --state ESTABLISHED              \
           -m limit --limit 1/hour --limit-burst 1   \
           -j LOG --log-prefix "iptables: Tun ...  "

  iptables -A TUNLOG                                 \
           -m state --state NEW                      \
           -m limit --limit 1/minute --limit-burst 1 \
           -j LOG --log-prefix "iptables: Tun-New  "
  
  iptables -A TUNLOG                                 \
           -m state --state RELATED                  \
           -m limit --limit 1/minute --limit-burst 1 \
           -j LOG --log-prefix "iptables: Tun-Rel  "
  
  iptables -A TUNLOG                                 \
           -m state --state INVALID                  \
           -m limit --limit 1/minute --limit-burst 1 \
           -j LOG --log-prefix "iptables: Tun-Bad  "
  
  iptables -A TUNLOG                                 \
           -j ACCEPT

The problem I experience is that whenever the dynamic-rule script fires, I get a log entry for an established-tunnel packet. Since the first script fires N times per hour, I get N times as many log entries for the tunnel as I want. This makes my examination of the firewall log more tedious and error prone than it should be.

This seems to me to be a bug in iptables/netfilter. I am using iptables 1.2.11 and kernel 2.4.28 with the ebtables patch 'ebtables-brnf-8_vs_2_4_28_diff'.

Paul Kosinski