RE: [LARTC] ipchains iproute2 and port based routing

["Marco Balle" <mb@monster-server.de>]

Next :)


>You could always try that very same diagnosing ipchains rule in your
>forward chain, i.e. "ipchains -A forward -j DENY -l".  Then you'll see
>that the de-masqueraded packet is denied passing through the forward
>chain.  (At least that's my guess....)

I did. I understand the deny chain now - it was my mistake.

In the forward chain, I added the deny chain:
ipchains -A input -i eth2 -j DENY -l
But no packets arrive there.

I write it down, the short version:

Chain input (policy ACCEPT):
target     prot opt     source                destination
ports
-          icmp ------  192.168.0.0/24       anywhere              any
->   any
Chain forward (policy ACCEPT):
target     prot opt     source                destination
ports
MASQ       all  ------  192.168.0.0/24       anywhere              n/a
DENY       all  ----l-  anywhere             anywhere              n/a
Chain output (policy ACCEPT):

So the default policy is accept. With a ping of 4 tries, the forward -
MASQ chain added 4 pakets and the icmp mark chain added also 4 packets.
But no one in the DENY chain.


The same with the deny chain in the input chain:
ipchains -A forward -j DENY -l

Chain input (policy ACCEPT):
target     prot opt     source                destination
ports
-          icmp ------  192.168.0.0/24       anywhere              any
->   any
DENY       all  ----l-  anywhere             anywhere              n/a
Chain forward (policy ACCEPT):
target     prot opt     source                destination
ports
MASQ       all  ------  192.168.0.0/24       anywhere              n/a
Chain output (policy ACCEPT):

There with the same ping, 4 packets added in the MASQ, in the icmp _and_
in the input deny chain.

Hmm, if I don't make anything wrong, the packets get lost after the
input and before the forward chain.


What do you think?


Now it is time to go to bed, its 11:30pm here. 
I am at home tomorrow at 5pm CET (hope so) and will try again - so long
to it works, the next day is free for me, so I have the whole night
tomorrow.



Marco




_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/