How to ignore incoming packets

How to ignore incoming packets

[Sudheimer]

Hi everyone,

I would like diald to ignore any incoming connection attempts.

For example if I get incoming packages to my tcp port 23 (telnet), they
fit the default rule of diald and keep up the line for 2 minutes (keepup
tcp 120 any). I do not have telnetd running on this port and have also
an ipchains packet denying these packets.

Nevertheless these packages match the final catch-all rule of diald and
keep up the line for 2 minutes (keepup tcp 120 any).

On the other hand, I do not want to define a rule like "ignore telnet
packets" because this would also match my own telnet-sessions to remote
telnet servers. 

If it were possible for diald to distinguish between incoming and
outgoing packets one could say somthing like "ignore incoming tcp SYN
packets". Is there something like that?


Joachim

Re: How to ignore incoming packets

[Mark Frey]

Hi Joachim,

As far as I know, you can only do this if you have a static IP address. 
  Then you can filter based on your fixed ip.daddr :

ignore tcp ip.daddr=<your fixed ip>,tcp.dest=tcp.telnet

I'd also like to know of any way to accomplish this with a dynamic address!

Mark.


Sudheimer wrote:
> Hi everyone,
> 
> I would like diald to ignore any incoming connection attempts.
> 
> For example if I get incoming packages to my tcp port 23 (telnet), they
> fit the default rule of diald and keep up the line for 2 minutes (keepup
> tcp 120 any). I do not have telnetd running on this port and have also
> an ipchains packet denying these packets.
> 
> Nevertheless these packages match the final catch-all rule of diald and
> keep up the line for 2 minutes (keepup tcp 120 any).
> 
> On the other hand, I do not want to define a rule like "ignore telnet
> packets" because this would also match my own telnet-sessions to remote
> telnet servers. 
> 
> If it were possible for diald to distinguish between incoming and
> outgoing packets one could say somthing like "ignore incoming tcp SYN
> packets". Is there something like that?
> 
> 
> Joachim
> -
> To unsubscribe from this list: send the line "unsubscribe linux-diald" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: How to ignore incoming packets

[Sudheimer]

Hi,

thanks for your hint, Mark.

> As far as I know, you can only do this if you have a static IP address.
>   Then you can filter based on your fixed ip.daddr :
> 
> ignore tcp ip.daddr=<your fixed ip>,tcp.dest=tcp.telnet
> 
> I'd also like to know of any way to accomplish this with a dynamic address!
> 
It seems to be possible to re-read the config-files with a command to
the FIFO:

   echo reset > /var/run/diald.fifo

I can do this while watching with dctrl and it seems to work fine (i.e.
without changing connection status etc.)

I have not yet tested this with a rules file with changing own IPs,
though. I am new to diald and it will probably take me quite some time
to find out how to do this (and I am a bit short of time at the moment
:-( )

According to man diald
   var ip.saddr 12
defines the IP source address of a packet. Maybe one could use something
like this on a packet send by the own system once after getting the new
own IP. (Can't imagine how, though.) 

If not, one might have to find out the own address with ifconfig ...
|grep ... after each reconnection and use the result in the rules file.

Maybe somebody more familiar with diald can help or would like to dosome
research/testing on this and report to the list...



Jaochim


-------------------------------------------------------------------------
> 
> Sudheimer wrote:
> > Hi everyone,
> >
> > I would like diald to ignore any incoming connection attempts.
> >
> > For example if I get incoming packages to my tcp port 23 (telnet), they
> > fit the default rule of diald and keep up the line for 2 minutes (keepup
> > tcp 120 any). I do not have telnetd running on this port and have also
> > an ipchains packet denying these packets.
> >
> > Nevertheless these packages match the final catch-all rule of diald and
> > keep up the line for 2 minutes (keepup tcp 120 any).
> >
> > On the other hand, I do not want to define a rule like "ignore telnet
> > packets" because this would also match my own telnet-sessions to remote
> > telnet servers.
> >
> > If it were possible for diald to distinguish between incoming and
> > outgoing packets one could say somthing like "ignore incoming tcp SYN
> > packets". Is there something like that?
> >
> >
> > Joachim

Re: How to ignore incoming packets

[Mark Frey]

Hi Joachim,

Thank you for pointing out the reset command!

Diald passes your ip address to the ip-up script, if defined.  You could 
make a template rule file with a unique pattern everywhere you want your 
own ip address to be, with lines something like this:

ignore tcp ip.daddr=192.168.255.255,tcp.dest=tcp.telnet

Then in the ip-up script ($3 contains the new local IP address):

cat template_file | sed s/192.168.255.255/$3/g >diald_rule_file
echo reset >/var/run/diald.fifo

I'll see if I can find time to try this out here.

Mark.



Sudheimer wrote:
> Hi,
> 
> thanks for your hint, Mark.
> 
> 
>>As far as I know, you can only do this if you have a static IP address.
>>  Then you can filter based on your fixed ip.daddr :
>>
>>ignore tcp ip.daddr=<your fixed ip>,tcp.dest=tcp.telnet
>>
>>I'd also like to know of any way to accomplish this with a dynamic address!
>>
> 
> It seems to be possible to re-read the config-files with a command to
> the FIFO:
> 
>    echo reset > /var/run/diald.fifo
> 
> I can do this while watching with dctrl and it seems to work fine (i.e.
> without changing connection status etc.)
> 
> I have not yet tested this with a rules file with changing own IPs,
> though. I am new to diald and it will probably take me quite some time
> to find out how to do this (and I am a bit short of time at the moment
> :-( )
> 
> According to man diald
>    var ip.saddr 12
> defines the IP source address of a packet. Maybe one could use something
> like this on a packet send by the own system once after getting the new
> own IP. (Can't imagine how, though.) 
> 
> If not, one might have to find out the own address with ifconfig ...
> |grep ... after each reconnection and use the result in the rules file.
> 
> Maybe somebody more familiar with diald can help or would like to dosome
> research/testing on this and report to the list...
> 
> 
> 
> Jaochim
> 
> 
> -------------------------------------------------------------------------
> 
>>Sudheimer wrote:
>>
>>>Hi everyone,
>>>
>>>I would like diald to ignore any incoming connection attempts.
>>>
>>>For example if I get incoming packages to my tcp port 23 (telnet), they
>>>fit the default rule of diald and keep up the line for 2 minutes (keepup
>>>tcp 120 any). I do not have telnetd running on this port and have also
>>>an ipchains packet denying these packets.
>>>
>>>Nevertheless these packages match the final catch-all rule of diald and
>>>keep up the line for 2 minutes (keepup tcp 120 any).
>>>
>>>On the other hand, I do not want to define a rule like "ignore telnet
>>>packets" because this would also match my own telnet-sessions to remote
>>>telnet servers.
>>>
>>>If it were possible for diald to distinguish between incoming and
>>>outgoing packets one could say somthing like "ignore incoming tcp SYN
>>>packets". Is there something like that?
>>>
>>>
>>>Joachim
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-diald" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: How to ignore incoming packets

[Mark Frey]

Hi Joachim,

I've created a new template rule file here and it seems to be working 
well :-)

All the rules match only on my own dynamic source address, thus ignoring 
*anything* coming in.  If I don't originate packets the link will not be 
kept up.  This assumes the firewall drops everything not associated with 
an allowed connection and does not generate reject packets.

I might have to add some specific rules if I need for example incoming 
udp streaming media to keep the link up if the protocol does not 
generate periodic outgoing packets back to the server...

Here's the bare-bones template file:

# Rule for while offline, proxy address:
accept any 120 ip.saddr=192.168.0.1

# Rules for when we're online:

# Keep up for 29 minutes after last web access
accept tcp 1740 ip.saddr=192.168.255.255,tcp.dest=tcp.http
accept tcp 1740 ip.saddr=192.168.255.255,tcp.dest=tcp.https

# Keep link up for a while after popping mail
accept tcp 900 ip.saddr=192.168.255.255,tcp.dest=tcp.pop3

# Once the link is no longer live, we try to shut down the connection
# quickly. Note that if the link is already down, a state change
# will not bring it back up.
keepup tcp 30 ip.saddr=192.168.255.255,!tcp.live

# 2 minutes for anything else we originate
accept any 120 ip.saddr=192.168.255.255

---------
And, the commands to put in the ip-up script (your file and fifo 
locations may vary):

# adjust filters for our current ip address:
cat /usr/lib/diald/our.filter.template | sed s/192.168.255.255/$3/g 
 >/usr/lib/diald/our.filter
echo reset > /etc/diald/diald.ctl

Mark.



Mark Frey wrote:
> Hi Joachim,
> 
> Thank you for pointing out the reset command!
> 
> Diald passes your ip address to the ip-up script, if defined.  You could 
> make a template rule file with a unique pattern everywhere you want your 
> own ip address to be, with lines something like this:
> 
> ignore tcp ip.daddr=192.168.255.255,tcp.dest=tcp.telnet
> 
> Then in the ip-up script ($3 contains the new local IP address):
> 
> cat template_file | sed s/192.168.255.255/$3/g >diald_rule_file
> echo reset >/var/run/diald.fifo
> 
> I'll see if I can find time to try this out here.
> 
> Mark.
> 
> 

Re: How to ignore incoming packets

[sudix]

Mark Frey wrote:
> 
> Hi Joachim,
> 
> I've created a new template rule file here and it seems to be working
> well :-)
> 
Thank's Mark :-))

Joachim