iptables forwarding packets on the same interface

All of lore.kernel.org
 help / color / mirror / Atom feed

* iptables forwarding packets on the same interface
@ 2010-11-18 20:26 Daniel Scott
  2010-11-18 20:56 ` Marek Kierdelewicz
  0 siblings, 1 reply; 5+ messages in thread
From: Daniel Scott @ 2010-11-18 20:26 UTC (permalink / raw)
  To: netfilter

Hi,

I have an iptables firewall configured as:

192.168.1.1

which handles the routing for our network.

I have added a separate router on:

192.168.1.2 which provides access to a different network:

192.168.10.0/24.

I have added a route on 192.168.1.1:

192.168.10.0 192.168.1.2 255.255.255.0 UG 0 0 0 eth1

so that packets from the network are routed through the .2 gateway.
However, iptables is blocking the packets when I route from a
different IP on the 192.168.1.0/24 network. i.e.

Ping from '1' network into '10' network:

Nov 17 17:18:30 fw kernel: [FIREWALL_LOG_CHAIN] IN= OUT=eth1
SRC=192.168.1.1 DST=192.168.1.42 LEN=112 TOS=0x00 PREC=0xC0 TTL=64
ID=25272 PROTO=ICMP TYPE=5 CODE=1 GATEWAY=192.168.1.2
[SRC=192.168.1.42 DST=192.168.10.10 LEN=84 TOS=0x00 PREC=0x00 TTL=63
ID=48895 PROTO=ICMP TYPE=0 CODE=0 ID=12034 SEQ=2 ]

DNS request from '10' network into '1' network:

Nov 18 10:19:50 fw kernel: [FIREWALL_LOG_CHAIN] IN=eth1 OUT=eth1
SRC=192.168.1.202 DST=192.168.10.10 LEN=71 TOS=0x00 PREC=0x00 TTL=63
ID=62146 PROTO=UDP SPT=53 DPT=38966 LEN=51

Am I doing this correctly? Can I 'route' packets back on to the same
interface, out via a different gateway. If so, can anyone tell me
which iptables/routing rule(s) I need to add to forward between
different network IPs on the same physical interface.

Thanks,

Dan

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: iptables forwarding packets on the same interface
  2010-11-18 20:26 iptables forwarding packets on the same interface Daniel Scott
@ 2010-11-18 20:56 ` Marek Kierdelewicz
  2010-11-18 21:37   ` Daniel Scott
  0 siblings, 1 reply; 5+ messages in thread
From: Marek Kierdelewicz @ 2010-11-18 20:56 UTC (permalink / raw)
  To: Daniel Scott; +Cc: netfilter

>Hi,

Hi,

>Am I doing this correctly? Can I 'route' packets back on to the same
>interface, out via a different gateway.

You should be able to do that. You are probably filtering some of the
traffic.

> If so, can anyone tell me
>which iptables/routing rule(s) I need to add to forward between
>different network IPs on the same physical interface.

Please send output of iptables-save and ip ro sh from both routers.

Best regards,
Marek

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: iptables forwarding packets on the same interface
  2010-11-18 20:56 ` Marek Kierdelewicz
@ 2010-11-18 21:37   ` Daniel Scott
  2010-11-18 23:24     ` Marek Kierdelewicz
  0 siblings, 1 reply; 5+ messages in thread
From: Daniel Scott @ 2010-11-18 21:37 UTC (permalink / raw)
  To: Marek Kierdelewicz; +Cc: netfilter

[-- Attachment #1: Type: text/plain, Size: 798 bytes --]

Hi,

Thanks for the quick response:

On Thu, Nov 18, 2010 at 15:56, Marek Kierdelewicz <marek@piasta.pl> wrote:
>> If so, can anyone tell me
>>which iptables/routing rule(s) I need to add to forward between
>>different network IPs on the same physical interface.
>
> Please send output of iptables-save and ip ro sh from both routers.

192.168.1.0/24 dev eth1  proto kernel  scope link  src 192.168.1.1
192.168.10.0/24 via 192.168.1.2 dev eth1
169.254.0.0/16 dev eth1  scope link  metric 1002
169.254.0.0/16 dev eth0  scope link  metric 1003
18.40.0.0/16 dev eth0  proto kernel  scope link  src 18.40.XXX.XXX
default via 18.40.0.1 dev eth0

iptables-save output is attached. The other router (192.168.1.2) is a
SonicWall device, which has IPs on both 10 and 1 networks.

Thanks for your help,

Dan

[-- Attachment #2: iptables-save-output.txt --]
[-- Type: text/plain, Size: 7804 bytes --]

# Generated by iptables-save v1.4.5 on Thu Nov 18 16:29:21 2010
*nat
:PREROUTING ACCEPT [74020938:6740837900]
:POSTROUTING ACCEPT [2302916:158681492]
:OUTPUT ACCEPT [133475:10757082]
-A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 18.40.XXX.XXX 
COMMIT
# Completed on Thu Nov 18 16:29:21 2010
# Generated by iptables-save v1.4.5 on Thu Nov 18 16:29:21 2010
*filter
:INPUT DROP [1:337]
:FORWARD DROP [3:564]
:OUTPUT DROP [6:1464]
:LOG_CHAIN - [0:0]
:SSH_CHECK - [0:0]
-A INPUT -i lo -j ACCEPT 
-A INPUT -m state --state INVALID -j DROP 
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP 
-A INPUT -s 192.168.1.0/24 -i eth0 -j DROP 
-A INPUT -s 18.40.0.0/16 -i eth1 -j DROP 
-A INPUT -s 192.168.10.0/24 -i eth1 -j ACCEPT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j SSH_CHECK 
-A INPUT -s 192.168.1.0/24 -d 192.168.1.1/32 -i eth1 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -d 18.40.XXX.XXX/32 -i eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 192.168.1.0/24 -d 192.168.1.1/32 -i eth1 -p icmp -m icmp --icmp-type any -m limit --limit 1/sec -j ACCEPT 
-A INPUT -s 192.168.1.0/24 -d 192.168.1.1/32 -i eth1 -p tcp -m state --state NEW -m tcp --dport 5666 -j ACCEPT 
-A INPUT -s 192.168.1.0/24 -d 192.168.1.1/32 -i eth1 -p tcp -m state --state NEW -m tcp --dport 4949 -j ACCEPT 
-A INPUT -s 192.168.1.0/24 -d 192.168.1.1/32 -i eth1 -p udp -m udp --sport 123 -m multiport --dports 123 -m state --state NEW -j ACCEPT 
-A INPUT -s 192.168.1.0/24 -d 192.168.1.1/32 -i eth1 -p udp -m udp --sport 1024:65535 -m multiport --dports 123 -m state --state NEW -j ACCEPT 
-A INPUT -i eth0 -p tcp -m multiport --dports 67,135,137,138,139,445,631,5353 -j DROP 
-A INPUT -i eth0 -p udp -m multiport --dports 67,135,137,138,139,445,631,5353 -j DROP 
-A INPUT -i eth0 -p tcp -m multiport --dports 68 -j DROP 
-A INPUT -i eth0 -p udp -m multiport --dports 68 -j DROP 
-A INPUT -i eth0 -p tcp -m multiport --dports 123 -j DROP 
-A INPUT -i eth0 -p udp -m multiport --dports 123 -j DROP 
-A INPUT -i eth0 -p tcp -m multiport --dports 1947,2223 -j DROP 
-A INPUT -i eth0 -p udp -m multiport --dports 1947,2223 -j DROP 
-A INPUT -d 192.168.1.0/24 -i eth1 -p tcp -m multiport --dports 67,135,137,138,139,445,631,5353 -j DROP 
-A INPUT -d 192.168.1.0/24 -i eth1 -p udp -m multiport --dports 67,135,137,138,139,445,631,5353 -j DROP 
-A INPUT -j LOG_CHAIN 
-A FORWARD -d 192.168.1.0/24 -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -d 192.168.10.0/24 -i eth1 -o eth1 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.10.0/24 -d 192.168.1.0/24 -i eth1 -o eth1 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p udp -m udp --sport 123 -m multiport --dports 123 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p icmp -m icmp --icmp-type any -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 80,443,8080,8181,4848,4849 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 888 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 25,465 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 22 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 143,993,110,995 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 53 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 20,21,115,990,873 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 88,464,749,751,389,636 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 5222,5223 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 1863 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 5190 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 6881:6999 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 444,41443 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 446,447,9443 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 9418 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 1494 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 6666,6667 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 10000 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 1688 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 43 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 1500 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p tcp -m tcp --sport 1024:65535 -m multiport --dports 3306 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p udp -m udp --sport 1024:65535 -m multiport --dports 123 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p udp -m udp --sport 1024:65535 -m multiport --dports 5222,5223 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p udp -m udp --sport 1024:65535 -m multiport --dports 1863 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p udp -m udp --sport 1024:65535 -m multiport --dports 53 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p udp -m udp --sport 1024:65535 -m multiport --dports 6881:6999 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p udp -m udp --sport 1024:65535 -m multiport --dports 444,41443 -m state --state NEW -j ACCEPT 
-A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -p udp -m udp --sport 1024:65535 -m multiport --dports 1494 -m state --state NEW -j ACCEPT 
-A FORWARD -j LOG_CHAIN 
-A OUTPUT -o lo -j ACCEPT 
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -d 192.168.10.0/24 -o eth1 -j ACCEPT 
-A OUTPUT -j LOG_CHAIN 
-A LOG_CHAIN -m limit --limit 20/min -j LOG --log-prefix "[FIREWALL_LOG_CHAIN] " --log-level 6 
-A LOG_CHAIN -j DROP 
-A SSH_CHECK -m recent --set --name SSH --rsource 
-A SSH_CHECK -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH --rsource -j LOG --log-prefix "[FIREWALL_SSH_BRUTE] " --log-level 6 
-A SSH_CHECK -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH --rsource -j DROP 
COMMIT
# Completed on Thu Nov 18 16:29:21 2010

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: iptables forwarding packets on the same interface
  2010-11-18 21:37   ` Daniel Scott
@ 2010-11-18 23:24     ` Marek Kierdelewicz
  2010-11-18 23:39       ` Daniel Scott
  0 siblings, 1 reply; 5+ messages in thread
From: Marek Kierdelewicz @ 2010-11-18 23:24 UTC (permalink / raw)
  To: Daniel Scott; +Cc: netfilter

Hi,

> -A FORWARD -s 192.168.1.0/24 -d 192.168.10.0/24 -i eth1 -o eth1 -m
> state --state NEW -j ACCEPT 
>-A FORWARD -s 192.168.10.0/24 -d 192.168.1.0/24 -i eth1 -o eth1 -m
>state --state NEW -j ACCEPT

I think you're missing forwarding of ESTABLISHED,RELATED between
192.168.1.0/24 and 192.168.10.0/24. Try to change above rules to:

-A FORWARD -s 192.168.1.0/24 -d 192.168.10.0/24 -i eth1 -o eth1 -j ACCEPT 
-A FORWARD -s 192.168.10.0/24 -d 192.168.1.0/24 -i eth1 -o eth1 -j ACCEPT

Best regards,
Marek

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: iptables forwarding packets on the same interface
  2010-11-18 23:24     ` Marek Kierdelewicz
@ 2010-11-18 23:39       ` Daniel Scott
  0 siblings, 0 replies; 5+ messages in thread
From: Daniel Scott @ 2010-11-18 23:39 UTC (permalink / raw)
  To: Marek Kierdelewicz; +Cc: netfilter

Hi,

On Thu, Nov 18, 2010 at 18:24, Marek Kierdelewicz <marek@piasta.pl> wrote:
>> -A FORWARD -s 192.168.1.0/24 -d 192.168.10.0/24 -i eth1 -o eth1 -m
>> state --state NEW -j ACCEPT
>>-A FORWARD -s 192.168.10.0/24 -d 192.168.1.0/24 -i eth1 -o eth1 -m
>>state --state NEW -j ACCEPT
>
> I think you're missing forwarding of ESTABLISHED,RELATED between
> 192.168.1.0/24 and 192.168.10.0/24. Try to change above rules to:
>
> -A FORWARD -s 192.168.1.0/24 -d 192.168.10.0/24 -i eth1 -o eth1 -j ACCEPT
> -A FORWARD -s 192.168.10.0/24 -d 192.168.1.0/24 -i eth1 -o eth1 -j ACCEPT

Excellent. That seems to have fixed it, thanks.

Dan

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2010-11-18 23:39 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-11-18 20:26 iptables forwarding packets on the same interface Daniel Scott
2010-11-18 20:56 ` Marek Kierdelewicz
2010-11-18 21:37   ` Daniel Scott
2010-11-18 23:24     ` Marek Kierdelewicz
2010-11-18 23:39       ` Daniel Scott

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.