Blocking in NAT

Blocking in NAT

[James Lay]

Hey All,

Soäonce upon a time one could block using NAT, which was nice since I run
a spamfilter that grabs everything coming in to port 25 with:

iptables -t nat -A PREROUTING -m physdev --physdev-in eth0 ! -s 10.0.0.0/8
-p tcp --dport 25 -j DNAT --to-destination 10.0.0.1:25

For some reason, filtering in the nat table was deemed bad, so now I can
no longer drop things there.  So my question is, how do I block say...a
spammer from sending to port 25 now?  I can't use:

iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
-j DROP
or
iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
-j REJECT

Am I going to have to do something silly like send to an ip that's not on
my network:

iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
-j DNAT --to-destiation 172.16.1.1

I have to admit...loosing the DROP functionality in nat was a real
bummer....I had a great script that would block ANYTHING from an IP
address with the INPUT, FORWARD, and PREROUTING tables..not so much now
though ;)  Thanks for any input you can provide.

James 

Re: Blocking in NAT

[Jan Engelhardt]

On Saturday 2011-05-07 15:20, James Lay wrote:

>Hey All,
>
>So?once upon a time one could block using NAT, which was nice since I run
>a spamfilter that grabs everything coming in to port 25 with:
>
>iptables -t nat -A PREROUTING -m physdev --physdev-in eth0 ! -s 10.0.0.0/8
>-p tcp --dport 25 -j DNAT --to-destination 10.0.0.1:25
>
>For some reason, filtering in the nat table was deemed bad, so now I can
>no longer drop things there.  So my question is, how do I block say...a
>spammer from sending to port 25 now?  I can't use:
>
>iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
>-j DROP
>or
>iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
>-j REJECT


iptables -A INPUT (or FORWARD, depending on use case) -m physdev 
--physdev-in eth0 -s naughty.ip (-p tcp --dport 25) -j REJECT

Re: Blocking in NAT

[Nikolay Kichukov]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

or just block it in the -t mangle -A PREROUTING table.
Have a look at the packet flow diagram and you will  be good to go!

Cheers,
- -Nik

On 05/07/2011 05:54 PM, Jan Engelhardt wrote:
> On Saturday 2011-05-07 15:20, James Lay wrote:
> 
>> Hey All,
>>
>> So?once upon a time one could block using NAT, which was nice since I run
>> a spamfilter that grabs everything coming in to port 25 with:
>>
>> iptables -t nat -A PREROUTING -m physdev --physdev-in eth0 ! -s 10.0.0.0/8
>> -p tcp --dport 25 -j DNAT --to-destination 10.0.0.1:25
>>
>> For some reason, filtering in the nat table was deemed bad, so now I can
>> no longer drop things there.  So my question is, how do I block say...a
>> spammer from sending to port 25 now?  I can't use:
>>
>> iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
>> -j DROP
>> or
>> iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
>> -j REJECT
> 
> 
> iptables -A INPUT (or FORWARD, depending on use case) -m physdev 
> --physdev-in eth0 -s naughty.ip (-p tcp --dport 25) -j REJECT
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJNx6vAAAoJEDFLYVOGGjgXS30H/RmE9stI4q8nWbZ03ObdIJ5H
gMQiZ2EST/Rz6q/OL37bGdk5bkZcRhj72AqRkrxB57lZDDpsk8uEwIlhoW61J3uI
dFXrGRZAPtCOd4yrGoILKBuK0hLOr/qWHGhxyCXw+Oa4Boq1LUjQHmJSRynss7Ui
caSjV9AWq4f6hmY3tLTQd8pXsi5zTOGKHSYwlRuoPeiUIiHZc9QkFAA6BOMw3Pl5
2NjjpOYAiRwt7/qbCWHaQkqsxvv3JD3tO/RT+Mg41cuOnuLj5945h7IktkbxVKj7
p7xvWJtUHDyD01A+rhb7B3lUn95eM3Hv3nBsAhnbcsXMQl/TO23/2jnsGuvxcbs=
=Hqow
-----END PGP SIGNATURE-----

Re: Blocking in NAT

[Jan Engelhardt]

On Monday 2011-05-09 10:54, Nikolay Kichukov wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Hi,
>
>or just block it in the -t mangle -A PREROUTING table.
>Have a look at the packet flow diagram and you will  be good to go!

Well, there is a reason the table is called "filter".

Blocking in NAT

[James Lay]

Bleh...nuked the email before I could respond....thanks Jan...the input
chain did the trick.

James