Conntrack not recording packets going through a firewall

Conntrack not recording packets going through a firewall

[David J Craigon]

Hello,

I'm trying to build a firewall using Linux, iptables and conntrack. My
set up is pretty simple- I've got a computer with three interfaces-
one pointing to the internet, and two networks for different
"customers".


Internet--------Firewall------Customer 1
                           |
                           ----------Customer 5



Customer 1 has 10.72.2.0/24. Customer 5 has 10.72.3.0/24. Both
customers have a server 10.72.2/3.3 running httpd on port 80.

Now, both Customer servers can get to the internet, and the internet
can get to them, but Customer 1's server can't get to Customer 5's
server.

Here is my iptables -L:

[root@e1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
Network-1  all  --  anywhere             10.72.2.0/24
Network-5  all  --  anywhere             10.72.3.0/24

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain Network-1 (1 references)
target     prot opt source               destination
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     tcp  --  anywhere             10.72.2.3           state NEW
tcp dpt:http
ACCEPT     all  --  anywhere             anywhere            state
RELATED,ESTABLISHED
REJECT     all  --  anywhere             anywhere
reject-with icmp-host-prohibited

Chain Network-5 (1 references)
target     prot opt source               destination
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     tcp  --  anywhere             10.72.3.3           state NEW
tcp dpt:http
ACCEPT     tcp  --  anywhere             10.72.3.3           state NEW
tcp dpt:http
ACCEPT     all  --  anywhere             anywhere            state
RELATED,ESTABLISHED
REJECT     all  --  anywhere             anywhere
reject-with icmp-host-prohibited

Chain RH-Firewall-1-INPUT (1 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:router
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state
RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:ssh
REJECT     all  --  anywhere             anywhere
reject-with icmp-host-prohibited


As you can see, I've got a separate chain for each customer.  As you
can also see, I'm using the --state RELATED, ESTABLISHED feature using
conntrack.

When packets go from each server to the internet, a line appears
correctly in /proc/net/ip_conntrack. Packets then get let back in.

When I try and get to the webpage on Customer 5 from Customer 1, the
HTTP connection SYN packet gets through to Customer 5, but the SYN+ACK
gets blocked on the way back, and the connection does not appear in
/proc/net/ip_conntrack. Any idea why?


NB. I'm trying all this out with virtual machines currently, but I
don't think that should affect things at all.

Thanks for any help,

David

Re: Conntrack not recording packets going through a firewall

[Mike Wright]

David J Craigon wrote:
> Hello,
> 
> I'm trying to build a firewall using Linux, iptables and conntrack. My
> set up is pretty simple- I've got a computer with three interfaces-
> one pointing to the internet, and two networks for different
> "customers".
> 
> 
> Internet--------Firewall------Customer 1
>                            |
>                            ----------Customer 5
> 
> 
> 
> Customer 1 has 10.72.2.0/24. Customer 5 has 10.72.3.0/24. Both
> customers have a server 10.72.2/3.3 running httpd on port 80.
> 
> Now, both Customer servers can get to the internet, and the internet
> can get to them, but Customer 1's server can't get to Customer 5's
> server.

Hi David,

Perhaps you need "routes" established for those subnets.

ip route add 10.72.2.0/24 dev ethX   #customer1's nic
ip route add 10.72.3.0/24 dev ethY   #customer5's nic

hth,
:m)

Re: Conntrack not recording packets going through a firewall

[David J Craigon]

No, the routing is definitely working 8-). Otherwise how could all
traffic go from the internet to these servers? They have no other
internet connection than through the firewall.

It all works OK if you turn off iptables on the firewall, too.

2009/1/21 Mike Wright <mike.wright@mailinator.com>:
> David J Craigon wrote:
>>
>> Hello,
>>
>> I'm trying to build a firewall using Linux, iptables and conntrack. My
>> set up is pretty simple- I've got a computer with three interfaces-
>> one pointing to the internet, and two networks for different
>> "customers".
>>
>>
>> Internet--------Firewall------Customer 1
>>                           |
>>                           ----------Customer 5
>>
>>
>>
>> Customer 1 has 10.72.2.0/24. Customer 5 has 10.72.3.0/24. Both
>> customers have a server 10.72.2/3.3 running httpd on port 80.
>>
>> Now, both Customer servers can get to the internet, and the internet
>> can get to them, but Customer 1's server can't get to Customer 5's
>> server.
>
> Hi David,
>
> Perhaps you need "routes" established for those subnets.
>
> ip route add 10.72.2.0/24 dev ethX   #customer1's nic
> ip route add 10.72.3.0/24 dev ethY   #customer5's nic
>
> hth,
> :m)
>

Re: Conntrack not recording packets going through a firewall

[David J Craigon]

Think I might of misunderstood your email. What I want to happen is
for all traffic to go through the firewall. Customer 1 and Customer 5
are on separate VLANs. I want Customer 5 to be able to access Customer
1's server as if it was any other host on the internet.

Does that make more sense?

2009/1/21 David J Craigon <david@craigon.co.uk>:
> No, the routing is definitely working 8-). Otherwise how could all
> traffic go from the internet to these servers? They have no other
> internet connection than through the firewall.
>
> It all works OK if you turn off iptables on the firewall, too.
>
> 2009/1/21 Mike Wright <mike.wright@mailinator.com>:
>> David J Craigon wrote:
>>>
>>> Hello,
>>>
>>> I'm trying to build a firewall using Linux, iptables and conntrack. My
>>> set up is pretty simple- I've got a computer with three interfaces-
>>> one pointing to the internet, and two networks for different
>>> "customers".
>>>
>>>
>>> Internet--------Firewall------Customer 1
>>>                           |
>>>                           ----------Customer 5
>>>
>>>
>>>
>>> Customer 1 has 10.72.2.0/24. Customer 5 has 10.72.3.0/24. Both
>>> customers have a server 10.72.2/3.3 running httpd on port 80.
>>>
>>> Now, both Customer servers can get to the internet, and the internet
>>> can get to them, but Customer 1's server can't get to Customer 5's
>>> server.
>>
>> Hi David,
>>
>> Perhaps you need "routes" established for those subnets.
>>
>> ip route add 10.72.2.0/24 dev ethX   #customer1's nic
>> ip route add 10.72.3.0/24 dev ethY   #customer5's nic
>>
>> hth,
>> :m)
>>
>

Re: Conntrack not recording packets going through a firewall

[Mike Wright]

David J Craigon wrote:
> Think I might of misunderstood your email. What I want to happen is
> for all traffic to go through the firewall. Customer 1 and Customer 5
> are on separate VLANs. I want Customer 5 to be able to access Customer
> 1's server as if it was any other host on the internet.
> 
> Does that make more sense?
> 
> 2009/1/21 David J Craigon <david@craigon.co.uk>:
> 
>>No, the routing is definitely working 8-). Otherwise how could all
>>traffic go from the internet to these servers? They have no other
>>internet connection than through the firewall.

Not too sure about VLANs but I have a 3-legged firewall/router with 
discrete network cards.

I just removed the route to my DMZ and now I can't reach it.  Hosts on 
my DMZ can still see my LAN and the internet because 1)net is on default 
route and 2)route to LAN still exists.

Ping a DMZ host from a LAN host and I see 100% packet loss.

I re-added the route:  ip route add DMZ/24 dev eth1

Voila', ping starts to work.

:m)

Re: Conntrack not recording packets going through a firewall

[David J Craigon]

well whatever. Routing, schmoting. If I turn off IPTables, everything
can see everything else fine.

2009/1/21 Mike Wright <mike.wright@mailinator.com>:
> David J Craigon wrote:
>>
>> Think I might of misunderstood your email. What I want to happen is
>> for all traffic to go through the firewall. Customer 1 and Customer 5
>> are on separate VLANs. I want Customer 5 to be able to access Customer
>> 1's server as if it was any other host on the internet.
>>
>> Does that make more sense?
>>
>> 2009/1/21 David J Craigon <david@craigon.co.uk>:
>>
>>> No, the routing is definitely working 8-). Otherwise how could all
>>> traffic go from the internet to these servers? They have no other
>>> internet connection than through the firewall.
>
> Not too sure about VLANs but I have a 3-legged firewall/router with discrete
> network cards.
>
> I just removed the route to my DMZ and now I can't reach it.  Hosts on my
> DMZ can still see my LAN and the internet because 1)net is on default route
> and 2)route to LAN still exists.
>
> Ping a DMZ host from a LAN host and I see 100% packet loss.
>
> I re-added the route:  ip route add DMZ/24 dev eth1
>
> Voila', ping starts to work.
>
> :m)
>

Re: Conntrack not recording packets going through a firewall

[Mike Wright]

David J Craigon wrote:
> well whatever. Routing, schmoting. If I turn off IPTables, everything
> can see everything else fine.

The reason you need routing statements is because your /24 networks
can't see each other.

Put them on the SAME subnet or route them.  Easy, no?

ps: -1

Re: Conntrack not recording packets going through a firewall

[David J Craigon]

I seem to have ended up arguing on the internet, which wasn't really
my idea :-(.

Right, let's go through this again.

Internet--------Firewall------Server 1
                          |
                          ----------Server 5

I'm working on the firewall, a linux box. The firewall has addresses
10.72.2.1, 10.72.3.1 and 10.69.2.3, which goes off to the internet.
Server 1 has IP 10.72.2.3 and default gateway 10.72.2.1. Server 5 has
IP 10.72.3.3 and default gateway 10.72.3.1.

Server 1 can see server 5. Server 1 can see the internet. Server 5 can
see server 1. Server 5 can see the internet.. There are absolutely no
routing problems whatsoever: Look! Here they are pinging each other!

[root@server5 ~]# ping 10.72.2.3
PING 10.72.2.3 (10.72.2.3) 56(84) bytes of data.
64 bytes from 10.72.2.3: icmp_seq=1 ttl=63 time=2.83 ms
64 bytes from 10.72.2.3: icmp_seq=2 ttl=63 time=1.14 ms
64 bytes from 10.72.2.3: icmp_seq=3 ttl=63 time=1.48 ms

--- 10.72.2.3 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 1.144/1.818/2.830/0.729 ms
[root@server5 ~]# traceroute 10.72.2.3
traceroute to 10.72.2.3 (10.72.2.3), 30 hops max, 40 byte packets
 1  10.72.3.1 (10.72.3.1)  4.367 ms  1.212 ms  5.749 ms
 2  10.72.2.3 (10.72.2.3)  5.196 ms  4.715 ms  5.163 ms
[root@server5 ~]#

The reason I'm on the netfilter list, is because I'm trying to use the
firewall linux box as a firewall. Like I say, with my rule sets,
connections don't work from one server to the other for http traffic.
See my original email.