From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tomas Bonnedahl Date: Wed, 19 Feb 2003 16:58:36 +0000 Subject: Re: [LARTC] full policy routing Message-Id: List-Id: References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable To: lartc@vger.kernel.org hello again martin, i sat down and kind of figured it out, all i have to do now is to write some flashy bash script like you did ;) this is what i got: routing tables main: all routes prohibit: prohibit 0/0 rules from defined1 -> 192.168.1/24 lookup main from defined2 -> 192.168.1/24 lookup main ... from definedN -> 192.168.1/24 lookup main from 192.168.1/24 -> x lookup main from x -> 192.168.1/24 lookup main from x -> x lookup prohibit where x here is an undefined network. the thing is now to really get it straigh with the prio in the rules. if you are able to, i would like a comment on it. thanks,=20 tomas On Tue, Feb 18, 2003 at 07:01:52PM -0600, Martin A. Brown wrote: > : what i have is an internal router that transports data from ten > : different defined networks and of course "internet traffic". one of > : these defined networks is our lan 192.168.1/24. > : > : the utopia that im trying to reach is that there is a routing table for > : each and every one of these defined networks. these routing tables will > : pretty much only say "192.168.1/24 is on eth1. drop all other traffic > : that is not destined for 192.168.1/24". of course the table for > : 192.168.1/24 will have routes for all of these networks plus a default > : route to the internet. i then use rules for directing "from network x, > : use table x". the main table will just have one route, to 192.168.1/24 > : so that "internet traffic" can get through. >=20 > I guess I can see why you'd want this, although I wouldn't recommend > relying on routing to enforce your security. It can't hurt as an > additional measure, though. >=20 > I think you could make good use of the prohibit route. In the example > script I just cooked up (see below), I have used a table whose sole > purpose is to return a prohibit route. This way, you can use the RPDB to > perform a lookup for any route to any other network. I'm not great at > algorithms, so I'm sure somebody else out there will have a better > suggestion for how to cheaply achieve the same end. That said, you should > be able to define your networks in the $CONFIG file and have a bunch of > rules entered saying--you can't go here from there. >=20 > I think the big benefit here is that you are specifically "DENY"ing > traffic based on source and destination pairings. This means you only > have to manage two routing tables, not number-of-networks tables. The > main routing table is still used by all hosts, unless the RPDB suggests > looking up in table prohibit-table. >=20 > : this is just for security, that a ipsec defined network cannot reach > : the voIP network and so on, every network should just be able to reach > : the lan. > : > : should this work? perhaps that was what you meant when you talked about > : RPDB? >=20 > Yes. Most definitely. >=20 > : btw, seems like trouble shooting with policy routing isnt the easiest > : ;x >=20 > Indeed. It takes a bit of patience, tcpdump, printing out all of the > routing tables and the RPDB, and some patience. But by remembering that > it's just a big stateless mechanism, you ease your burden. >=20 > Did I mention that it requires patience? >=20 > -Martin >=20 > # cat destinations > 172.16.0.0/24 ipsec > 172.17.108.0/24 voip > 192.168.132.0/24 modempool > 10.251.8.0/24 serverfarm > 172.195.44.0/24 turnip > 192.168.12.0/24 internal > 10.49.85.0/24 ldapnet >=20 >=20 >=20 > #! /bin/bash > # > # -- populate some tables >=20 > CONFIG=DEstinations >=20 > ALLNETS=3D$( awk '{print $1 }' $CONFIG ) >=20 > ip rule show | grep -Ev '^(0|32766|32767):|iif lo' \ > | while read PRIO RULE; do > ip rule del prio ${PRIO%%:*} $( echo $RULE | sed 's|all|0/0|' ) > done >=20 > TABLES=3D/etc/iproute2/rt_tables >=20 > grep -q prohibit-table $TABLES || echo 249 prohibit-table >> $TABLES > ip route add prohibit default table prohibit-table >=20 > while read NETADDR NETNAME GARBAGE ; do > # > # -- cycle through all of the networks, adding prohibit routes > #ot@piggles bonnedahl]# ./maketables.sh > for DEST in $ALLNETS ; do >=20 > test $DEST =3D $NETADDR && continue > ip rule add from $NETADDR to $DEST lookup prohibit-table >=20 > done >=20 > done < $CONFIG >=20 > --=20 > Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com >=20 >=20 _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/