ICMP Connections ...

ICMP Connections ...

[Chetan Nagaraja]

[-- Attachment #1: Type: text/plain, Size: 1021 bytes --]

Dear All,
First of all, let me introduce as a total newbie in filtering and iptables.
 
To ping a host in a different network, I have configured a dual homed[ two network interfaces] linux system to act as NAT router.
I have add a rule in the NAT table of iptables, to achieve the following.
If the Linux system recieves a icmp packet from a particular host in NETWORK A addressed to a particular HOST in NETWORK B , perform SNAT of the ICMP packet to that of the Linux System, so that the icmp replies reaches the Linux system.
 
The above is working very fine. The ICMP requests are reaching the expected destination. 
But I'am unable to understand the fact that the ICMP replies are reaching the host in NETWORK A which had generated the requests, without adding a DNAT rule for the same.
How is this possible, does iptables automatically redirect ICMP replies ?
And How to avoid the same.
 
Thanking you,
Chetan M N


		
---------------------------------
Do you Yahoo!?
Yahoo! Mail is new and improved - Check it out!

[-- Attachment #2: Type: text/html, Size: 1289 bytes --]

Re: ICMP Connections ...

[Antony Stone]

On Tuesday 24 August 2004 2:36 pm, Chetan Nagaraja wrote:

> Dear All,
> First of all, let me introduce as a total newbie in filtering and iptables.
>
> To ping a host in a different network, I have configured a dual homed[ two
> network interfaces] linux system to act as NAT router. I have add a rule in
> the NAT table of iptables, to achieve the following. If the Linux system
> recieves a icmp packet from a particular host in NETWORK A addressed to a
> particular HOST in NETWORK B , perform SNAT of the ICMP packet to that of
> the Linux System, so that the icmp replies reaches the Linux system.

I think you probably mean DNAT?

> The above is working very fine. The ICMP requests are reaching the expected
> destination. But I'am unable to understand the fact that the ICMP replies
> are reaching the host in NETWORK A which had generated the requests,
> without adding a DNAT rule for the same. How is this possible, does
> iptables automatically redirect ICMP replies ?

Yes, and not just ICMP.   Netfilter automatically applies reverse-nat to reply 
packets in accordance with the forward nat rules you specify for the original 
packets.

> And How to avoid the same.

What do you mean?

Regards,

Antony.

-- 
How I want a drink, alcoholic of course, after the heavy chapters involving 
quantum mechanics.

 - 3.14159265358979

                                                     Please reply to the list;
                                                           please don't CC me.

Re: ICMP Connections ...

[Aleksandar Milivojevic]

Chetan Nagaraja wrote:
> To ping a host in a different network, I have configured a dual homed[ 
> two network interfaces] linux system to act as NAT router.

[snip]

> But I'am unable to understand the fact that the ICMP replies are 
> reaching the host in NETWORK A which had generated the requests, without 
> adding a DNAT rule for the same.
> How is this possible, does iptables automatically redirect ICMP replies ?
> And How to avoid the same.

Yes, you specify that you want to do SNAT or DNAT in one direction, and 
Netfilter will handle returning packets (and only returning packets!) 
correctly.

BTW, what would be the purpuse of preventing this???  If the returned 
packet wasn't handled automatically, neither the firewall nor the host 
in network A would be able to handle it.  Firewall wouldn't be able to 
handle it since original ping request hasn't originated from it.  Host 
in network A (if packet managed to miraculasly reach it despite of 
incorrect destination IP address) wouldn't be able to handle it (other 
than forwarding it back to the firewall, if kernel configuration 
permits) since reply would have destination IP address of the firewall 
in the headers.  So really no point in avoiding this behaviour.

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7

Re: ICMP Connections ...

[Deepak Seshadri]

[-- Attachment #1: Type: text/plain, Size: 2631 bytes --]

Hi Chetan,

You do not need to have a DNAT rule for the packets to reach the host in Network A. SNAT & DNAT are 2 different NATing policies used for different purposes and at different chains.

Let's see if I can explain what is happening:

- An ICMP packet from host A destined to host B reaches the Linux box. Linux box does the SNATing (that is, the source IP is changed to that of the Linux box's outgoing interface IP) and an entry is made of the same in the ip_conntrack file.

NOTE: When the first packet in a new connection matches a NAT rule, the entire stream is automatically NATted henceforth. That is, every packet belonging to this connection does not need to go through the same rule but the action will be taken on all. Check this out -
http://iptables-tutorial.frozentux.net/chunkyhtml/tables.html

- The ICMP packet reaches the host b which in turn replies back to the Linux box.

- Using connection tracking & NATing, the Linux box then changes the destination IP to that of host A and sends out the ICMP reply to host A.

I do not understand why you would just want to ping the hosts in network B and not get the replies back to the host in network A. Nevertheless, you can add a rule in your MANGLE POSTROUTING chain to drop the icmp packets from reaching network A.

I hope this helps.
Best Regards,

Deepak
  ----- Original Message ----- 
  From: Chetan Nagaraja 
  To: netfilter@lists.netfilter.org 
  Sent: Tuesday, August 24, 2004 9:36 AM
  Subject: ICMP Connections ...


  Dear All,
  First of all, let me introduce as a total newbie in filtering and iptables.

  To ping a host in a different network, I have configured a dual homed[ two network interfaces] linux system to act as NAT router.
  I have add a rule in the NAT table of iptables, to achieve the following.
  If the Linux system recieves a icmp packet from a particular host in NETWORK A addressed to a particular HOST in NETWORK B , perform SNAT of the ICMP packet to that of the Linux System, so that the icmp replies reaches the Linux system.

  The above is working very fine. The ICMP requests are reaching the expected destination. 
  But I'am unable to understand the fact that the ICMP replies are reaching the host in NETWORK A which had generated the requests, without adding a DNAT rule for the same.
  How is this possible, does iptables automatically redirect ICMP replies ?
  And How to avoid the same.

  Thanking you,
  Chetan M N


------------------------------------------------------------------------------
  Do you Yahoo!?
  Yahoo! Mail is new and improved - Check it out!

[-- Attachment #2: Type: text/html, Size: 4192 bytes --]