Re: problem with iptables - wrong rules?

["Miguel González Castaños" <mgc@tid.es>]

Luca Ferrari escribió:

>On Wednesday 14 July 2004 09:36 Miguel González Castaños's cat walking on the 
>keyboard  wrote:
>
>  
>
>>Hi,
>>
>> I am not sure what is your network architecture but i assume this:
>>
>> You have a LAN connected (lets call it LAN1) to the Internet through
>>the linux firewall (192.168.1.7). This firewall acts also as a router
>>being connected to the 192.168.1.8 router which is connected to
>>different LANs.
>>
>> With the DROP rule you are blocking packets destined to 192.168.1.8 and
>>come from anywhere (in this case Internet and LAN1).
>>
>> I assume when you say have NATTED the connection, you have NATTED
>>connections from LAN1 to the Internet and maybe connections from the
>>other LANs, am I wrong ? (maybe you should give us a picture or more
>>details of what you have in your NAT rules). If so, then LAN1 and the
>>other LANs are routed and not natted among them.
>>
>> Then, you should block destination to network 192.168.2.0, 192.168.4.0,
>>etc...
>>.html
>>    
>>
>
>I believe you're right, since I've natted only packets from/to the internet 
>and not another lan. Anyway, is there a way using iptables to intercepts 
>packets that are going to the 192.168.1.8 router? I'd like to log those 
>packets, but I believe that iptables acts before the kernel routing table, 
>thus it is not easy to intercept those packets.
>Any idea?
>
>Thanks,
>Luca
>
>  
>
you can try using a sniffer in your firewall such as ethereal or 
somethink like that and you could see the packets. Anyway, I suppose 
packets coming from LAN1 to the other LANs will have in the destination 
IP an IP like 192.168.2.x 192.168.4.x , so you have to block packets 
that match this criteria. Something like this (i am writting these rules 
roughly to give you the idea) :

 

$IPTABLES -A OUTPUT -o $INTIF  -d 192.168.2.0 -s 192.168.1.0 -j DROP
$IPTABLES -A OUTPUT -o $INTIF  -d 192.168.4.0 -s 192.168.1.0 -j DROP

I do not know (since i dont know how you are natting) if these rules could block the packets coming from internet to 192.168.2.x, etc...Anyway your setup is a bit weird...Wouldnt be more easy to block these packets in the router for the LANs instead of doing that in the firewall? Why dont you set a different range of IPs for LAN1? I bet it would be much easier...

HTH

Miguel



 
-
To unsubscribe from this list: send the line "unsubscribe linux-admin" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html