stateless 1:1 NAT

stateless 1:1 NAT

[Florin Andrei]

I've heard that stateless 1:1 NAT will be possible with the upcoming 
2.6.24 kernel.
I'd like to test that feature, but I'm not sure when it will actually be 
included. Will it be present in the release candidates for 2.6.24?
I just need a somewhat stable kernel tree to play with.

-- 
Florin Andrei

http://florin.myip.org/

Re: stateless 1:1 NAT

[Herbert Xu]

Florin Andrei <florin@andrei.myip.org> wrote:
> I've heard that stateless 1:1 NAT will be possible with the upcoming 
> 2.6.24 kernel.
> I'd like to test that feature, but I'm not sure when it will actually be 
> included. Will it be present in the release candidates for 2.6.24?
> I just need a somewhat stable kernel tree to play with.

Yes it will be.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: stateless 1:1 NAT

[Florin Andrei]

Herbert Xu wrote:
> Florin Andrei <florin@andrei.myip.org> wrote:
>> I've heard that stateless 1:1 NAT will be possible with the upcoming 
>> 2.6.24 kernel.
>> I'd like to test that feature, but I'm not sure when it will actually be 
>> included. Will it be present in the release candidates for 2.6.24?
>> I just need a somewhat stable kernel tree to play with.
> 
> Yes it will be.

So here's the thing I'm trying to solve.

Gigabit network.
Dual homed firewall, doing 1:1 NAT for a bunch of web servers. Some 
protocols are allowed inbound to the servers (the external, NATed 
addresses).
Firewall is running CentOS 5 (kernel 2.6.18)

I run pktgen on a test machine to generate a whole lot of small UDP 
packets with random source addresses. I send the packets to the 
firewall, to one of the 1:1 NATed addresses, to a port that's blocked by 
the firewall.
Meanwhile, I'm downloading a 2GB file from a web server through the 
firewall, in a while [ 1 ] loop, to monitor the functioning of the firewall.

When I start the UDP flood, the current download is able to finish up, 
but a new one won't start. The firewall has one of the cores pegged at 
100% CPU usage, with a lot of interrupts being generated all the time.
I assume there's something related to conntrack, that's why I want to 
test stateless rules. I assume the firewall has much less work to do if 
it's doing everything stateless, at least at the NAT level.

Is it going to be possible to combine stateless 1:1 NAT with stateful 
filtering?

By the way:
OpenBSD 4.1 as a firewall fails even worse in this test case (it freezes 
instantly).
OpenBSD 4.2 works fine under the UDP flood, as if nothing happened.

-- 
Florin Andrei

http://florin.myip.org/

Re: stateless 1:1 NAT

[Patrick McHardy]

Florin Andrei wrote:
> So here's the thing I'm trying to solve.
> 
> Gigabit network.
> Dual homed firewall, doing 1:1 NAT for a bunch of web servers. Some 
> protocols are allowed inbound to the servers (the external, NATed 
> addresses).
> Firewall is running CentOS 5 (kernel 2.6.18)
> 
> I run pktgen on a test machine to generate a whole lot of small UDP 
> packets with random source addresses. I send the packets to the 
> firewall, to one of the 1:1 NATed addresses, to a port that's blocked by 
> the firewall.
> Meanwhile, I'm downloading a 2GB file from a web server through the 
> firewall, in a while [ 1 ] loop, to monitor the functioning of the 
> firewall.
> 
> When I start the UDP flood, the current download is able to finish up, 
> but a new one won't start. The firewall has one of the cores pegged at 
> 100% CPU usage, with a lot of interrupts being generated all the time.
> I assume there's something related to conntrack, that's why I want to 
> test stateless rules. I assume the firewall has much less work to do if 
> it's doing everything stateless, at least at the NAT level.


Its not really related to the amount of work, conntrack has a fixed
limit of connections it will track, if you flood it with connections
it will stop accepting new ones at some point (you should see a message
about that in the ringbuffer). So as long as you have conntrack loaded
the problem will likely persist. But as I wrote, previously, 2.6.23 has
a change in the eviction algorithm that should make it behave much
better in the scenario you describe. It would be interesting if you
could test that. Alternatively you could of course just increase the
maximum number of conntracks.

> Is it going to be possible to combine stateless 1:1 NAT with stateful 
> filtering?


Yes, but that probably won't solve your problem.

> By the way:
> OpenBSD 4.1 as a firewall fails even worse in this test case (it freezes 
> instantly).
> OpenBSD 4.2 works fine under the UDP flood, as if nothing happened.


And Linux 2.6.23? :)

Re: stateless 1:1 NAT

[Florin Andrei]

Patrick McHardy wrote:
> 
> And Linux 2.6.23? :)

Alright, I get it. :-) Building kernel 2.6.23.1 as we speak.

-- 
Florin Andrei

http://florin.myip.org/

Re: stateless 1:1 NAT

[Florin Andrei]

Patrick McHardy wrote:
> Florin Andrei wrote:
>> OpenBSD 4.1 as a firewall fails even worse in this test case (it 
>> freezes instantly).
>> OpenBSD 4.2 works fine under the UDP flood, as if nothing happened.
> 
> And Linux 2.6.23? :)

Same as 2.6.18, actually maybe a little bit worse than .18: the current 
download does not even complete, and of course a new one doesn't start.

I may test 2.6.24 and stateless 1:1 NAT and we'll see what happens. I've 
been told that stateless 1:1 NAT is already in the .24_rc1 so I may test 
that.

-- 
Florin Andrei

http://florin.myip.org/

Re: stateless 1:1 NAT

[Herbert Xu]

Florin Andrei <florin@andrei.myip.org> wrote:
>
> Is it going to be possible to combine stateless 1:1 NAT with stateful 
> filtering?

It is but it's pointless unless you can somehow enumerate the
bad guys (or a superset of them) and redirect them to NOTRACK.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: stateless 1:1 NAT

[Florin Andrei]

Herbert Xu wrote:
> Florin Andrei <florin@andrei.myip.org> wrote:
>> I've heard that stateless 1:1 NAT will be possible with the upcoming 
>> 2.6.24 kernel.
>> I'd like to test that feature, but I'm not sure when it will actually be 
>> included. Will it be present in the release candidates for 2.6.24?
>> I just need a somewhat stable kernel tree to play with.
> 
> Yes it will be.

OK, if I download 2.6.24-rc1, will it have this feature already?
If not, when is it supposed to be included in the main kernel?

Thanks,

-- 
Florin Andrei

http://florin.myip.org/

Re: stateless 1:1 NAT

[Herbert Xu]

Florin Andrei <florin@andrei.myip.org> wrote:
>
> OK, if I download 2.6.24-rc1, will it have this feature already?

Yes.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: stateless 1:1 NAT

[Florin Andrei]

Herbert Xu wrote:
> Florin Andrei <florin@andrei.myip.org> wrote:
>> OK, if I download 2.6.24-rc1, will it have this feature already?
> 
> Yes.

OK, I want to test this feature with 2.6.24-rc2. I compiled 
iproute2-2.6.23 with your patch applied.
The problem is, I have no experience with tc (and very little experience 
with iproute2 in general). Can you give me an example on how to setup 
1:1 NAT for one system?

Let's say, the firewall has the addresses 10.123.0.10 (eth0 outside) and 
10.123.1.10 (eth1 inside), the server behind it is 10.123.1.253 and I 
want to map the server's address to 10.123.0.253 on the outside interface.
What are the parameters for tc to setup 1:1 NAT like that?

-- 
Florin Andrei

http://florin.myip.org/