RE: per user IP adresses

RE: per user IP adresses

[Khanh Tran]

I think what you want to do is continue to use your rule that drops all IRC
packets, but then add a rule that will -m --mac yo:ur:ma:ca:dd:re:ss and -j
ACCEPT for IRC ports.  Remember to put the match rule for your MAC address
after the drop rule since the rules are processed in order!


Khanh Tran
Network Operations
Sarah Lawrence College

-----Original Message-----
From: John Guntenaar [mailto:john@guntenaar.nl]
Sent: Sunday, May 04, 2003 3:19 PM
To: netfilter@lists.netfilter.org
Subject: RE: per user IP adresses


I think you didn't understand my question,

Ofcourse I can just set open that IP address, but I only want it to be
open for my own user (so the other users CAN'T use the IP)

I think I need things like -m owner --owner-uid or something but I can't
figure out a good rule, I get errors on everything I try :(

John

-----Oorspronkelijk bericht-----
Van: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] Namens SaVaGE
Verzonden: zondag 4 mei 2003 21:19
Aan: netfilter@lists.netfilter.org
Onderwerp: Re: per user IP adresses

Op zondag 4 mei 2003 20:38, schreef John Guntenaar:
> Hello,
>
> I have a linux machine with 4 IP addresses, I have a couple of friends
> on that machine and I don't allow them to use IRC, so I simply blocked
> the IRC ports, but I want to use IRC from the 4th IP without the other
> users being able to use it. I think I can reach that goal by using the
> owner match facility of iptables, though I can't find any good
examples
> with google, is it correct and can somebody post an example?
>
> Thanks in advantage,
>
> John

this one is very easy , you can use the same rule , you used before ,
but now 
you say :     ..........     -s ! $4th_ip -j DROP


Pascal

RE: per user IP adresses

[John Guntenaar]

That won't work either because the IP's are aliased, so the all have the
same MAC address.

I just want that userid 1234 can't use IP 1.2.3.4 BUT userid 1235 CAN
use that IP to bind for things like IRC sessions (for like a vhost or
something).

-----Oorspronkelijk bericht-----
Van: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] Namens Khanh Tran
Verzonden: maandag 5 mei 2003 2:10
Aan: john@guntenaar.nl
CC: netfilter@lists.netfilter.org
Onderwerp: RE: per user IP adresses

I think what you want to do is continue to use your rule that drops all
IRC
packets, but then add a rule that will -m --mac yo:ur:ma:ca:dd:re:ss and
-j
ACCEPT for IRC ports.  Remember to put the match rule for your MAC
address
after the drop rule since the rules are processed in order!


Khanh Tran
Network Operations
Sarah Lawrence College

-----Original Message-----
From: John Guntenaar [mailto:john@guntenaar.nl]
Sent: Sunday, May 04, 2003 3:19 PM
To: netfilter@lists.netfilter.org
Subject: RE: per user IP adresses


I think you didn't understand my question,

Ofcourse I can just set open that IP address, but I only want it to be
open for my own user (so the other users CAN'T use the IP)

I think I need things like -m owner --owner-uid or something but I can't
figure out a good rule, I get errors on everything I try :(

John

-----Oorspronkelijk bericht-----
Van: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] Namens SaVaGE
Verzonden: zondag 4 mei 2003 21:19
Aan: netfilter@lists.netfilter.org
Onderwerp: Re: per user IP adresses

Op zondag 4 mei 2003 20:38, schreef John Guntenaar:
> Hello,
>
> I have a linux machine with 4 IP addresses, I have a couple of friends
> on that machine and I don't allow them to use IRC, so I simply blocked
> the IRC ports, but I want to use IRC from the 4th IP without the other
> users being able to use it. I think I can reach that goal by using the
> owner match facility of iptables, though I can't find any good
examples
> with google, is it correct and can somebody post an example?
>
> Thanks in advantage,
>
> John

this one is very easy , you can use the same rule , you used before ,
but now 
you say :     ..........     -s ! $4th_ip -j DROP


Pascal

Re: per user IP adresses

[Arnt Karlsen]

On Mon, 5 May 2003 10:30:06 +0200, 
"John Guntenaar" <john@guntenaar.nl> wrote in message 
<000401c312e0$8bf85d70$0200a8c0@WKSJOHN>:

> That won't work either because the IP's are aliased, so the all have
> the same MAC address.

..you have everybody on the _same_ box???  'iptables -nL OUTPUT' ?

..on your lan firewall; check 'iptables -nl FORWARD' for _outbound_
rules, too, add port matches as needed.

> I just want that userid 1234 can't use IP 1.2.3.4 BUT userid 1235 CAN
> use that IP to bind for things like IRC sessions (for like a vhost or
> something).

..ok, hook up your userid to an ip alias and match that, _then_ drop
irc traffic for your bad(?) buddies.  Rule _sequence_ rules.  ;-)
You can set your irc sw to "talk" with just that one ip? 

..no, I'm old school and too lazy to type at irc speed, so I have 
_no_ idea.  ;-)

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

per user IP adresses

[John Guntenaar]

Hello,

I have a linux machine with 4 IP addresses, I have a couple of friends
on that machine and I don't allow them to use IRC, so I simply blocked
the IRC ports, but I want to use IRC from the 4th IP without the other
users being able to use it. I think I can reach that goal by using the
owner match facility of iptables, though I can't find any good examples
with google, is it correct and can somebody post an example?

Thanks in advantage,

John

Re: per user IP adresses

[SaVaGE]

Op zondag 4 mei 2003 20:38, schreef John Guntenaar:
> Hello,
>
> I have a linux machine with 4 IP addresses, I have a couple of friends
> on that machine and I don't allow them to use IRC, so I simply blocked
> the IRC ports, but I want to use IRC from the 4th IP without the other
> users being able to use it. I think I can reach that goal by using the
> owner match facility of iptables, though I can't find any good examples
> with google, is it correct and can somebody post an example?
>
> Thanks in advantage,
>
> John

this one is very easy , you can use the same rule , you used before , but now 
you say :     ..........     -s ! $4th_ip -j DROP


Pascal

RE: per user IP adresses

[John Guntenaar]

I think you didn't understand my question,

Ofcourse I can just set open that IP address, but I only want it to be
open for my own user (so the other users CAN'T use the IP)

I think I need things like -m owner --owner-uid or something but I can't
figure out a good rule, I get errors on everything I try :(

John

-----Oorspronkelijk bericht-----
Van: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] Namens SaVaGE
Verzonden: zondag 4 mei 2003 21:19
Aan: netfilter@lists.netfilter.org
Onderwerp: Re: per user IP adresses

Op zondag 4 mei 2003 20:38, schreef John Guntenaar:
> Hello,
>
> I have a linux machine with 4 IP addresses, I have a couple of friends
> on that machine and I don't allow them to use IRC, so I simply blocked
> the IRC ports, but I want to use IRC from the 4th IP without the other
> users being able to use it. I think I can reach that goal by using the
> owner match facility of iptables, though I can't find any good
examples
> with google, is it correct and can somebody post an example?
>
> Thanks in advantage,
>
> John

this one is very easy , you can use the same rule , you used before ,
but now 
you say :     ..........     -s ! $4th_ip -j DROP


Pascal

RE: per user IP adresses

[Chris Wilson]

Hi John,

> I think you didn't understand my question,
> 
> Ofcourse I can just set open that IP address, but I only want it to be
> open for my own user (so the other users CAN'T use the IP)
> 
> I think I need things like -m owner --owner-uid or something but I can't
> figure out a good rule, I get errors on everything I try :(

I don't think REJECT works in the OUTPUT chain, try DROP:

	iptables -A OUTPUT -p tcp --dport 6667 -m owner --owner-uid john
		-s 1.2.3.4 -j ACCEPT
	iptables -A OUTPUT -p tcp --dport 6667 -j DROP

where "john" is the user ID who is allowed to use IRC on IP address 
1.2.3.4 only.

Cheers, Chris.
-- 
   ___ __     _
 / __// / ,__(_)_  | Chris Wilson -- UNIX Firewall Lead Developer |
/ (_ / ,\/ _/ /_ \ | NetServers.co.uk http://www.netservers.co.uk |
\ _//_/_/_//_/___/ | 21 Signet Court, Cambridge, UK. 01223 576516 |

Re: per user IP adresses

[Joel Newkirk]

On Sun, 2003-05-04 at 14:38, John Guntenaar wrote:

I missed the start of this thread, so I backed up and reread it. :^)

> Hello,
> 
> I have a linux machine with 4 IP addresses, I have a couple of friends
> on that machine and I don't allow them to use IRC, so I simply blocked
> the IRC ports, but I want to use IRC from the 4th IP without the other
> users being able to use it. I think I can reach that goal by using the
> owner match facility of iptables, though I can't find any good examples
> with google, is it correct and can somebody post an example?
> 
> Thanks in advantage,
> 
> John

You need something constructed like this:

iptables -A OUTPUT -p tcp --dport 194 -m owner ! --uid-owner \ 1235 -j
REJECT --reject-with tcp-reset

or:

iptables -A OUTPUT -p tcp --dport 194 -m owner --uid-owner  \ 1235 -j
ACCEPT

I use a similar rule to prevent any user except root from being able to
connect to my LAN computers from my server.  You can add an additional
match to either rule to match outgoing interface or sourceIP if needed.
Is it really necessary to restrict IRC to only that single IP?
 
j

RE: per user IP adresses

[John Guntenaar]

Hi Joel,

Your LAN construction is exactly what I want, but I want that 1 of the 4
IPs can only bind to the 4th IP, but when I try any of your rules I get
errors :(

(And yes, I changed the real IP in 123.123.123.123 in here ;-))

jimbo:/var/www# iptables -A OUTPUT -p tcp -s 123.123.123.123/32 -m owner
! --uid-owner 1000 -j REJECT --reject-with tcp-reset
iptables: Invalid argument

jimbo:/var/www# iptables -A OUTPUT -p tcp --dport 6667 -m owner !
--uid-owner 1000 -j REJECT --reject-with tcp-reset
iptables: Invalid argument

jimbo:/var/www# iptables -A OUTPUT -p tcp --dport 194 -m owner !
--uid-owner \ 1235 -j REJECT --reject-with tcp-reset
iptables: Invalid argument

So what could be wrong?

Thanks,

John

-----Oorspronkelijk bericht-----
Van: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] Namens Joel Newkirk
Verzonden: dinsdag 6 mei 2003 1:46
Aan: john@guntenaar.nl
CC: netfilter@lists.netfilter.org
Onderwerp: Re: per user IP adresses

On Sun, 2003-05-04 at 14:38, John Guntenaar wrote:

I missed the start of this thread, so I backed up and reread it. :^)

> Hello,
> 
> I have a linux machine with 4 IP addresses, I have a couple of friends
> on that machine and I don't allow them to use IRC, so I simply blocked
> the IRC ports, but I want to use IRC from the 4th IP without the other
> users being able to use it. I think I can reach that goal by using the
> owner match facility of iptables, though I can't find any good
examples
> with google, is it correct and can somebody post an example?
> 
> Thanks in advantage,
> 
> John

You need something constructed like this:

iptables -A OUTPUT -p tcp --dport 194 -m owner ! --uid-owner \ 1235 -j
REJECT --reject-with tcp-reset

or:

iptables -A OUTPUT -p tcp --dport 194 -m owner --uid-owner  \ 1235 -j
ACCEPT

I use a similar rule to prevent any user except root from being able to
connect to my LAN computers from my server.  You can add an additional
match to either rule to match outgoing interface or sourceIP if needed.
Is it really necessary to restrict IRC to only that single IP?
 
j

RE: per user IP adresses

[Joel Newkirk]

On Tue, 2003-05-06 at 04:37, John Guntenaar wrote:
> Hi Joel,
> 
> Your LAN construction is exactly what I want, but I want that 1 of the 4
> IPs can only bind to the 4th IP, but when I try any of your rules I get
> errors :(
> 
> (And yes, I changed the real IP in 123.123.123.123 in here ;-))
> 
> jimbo:/var/www# iptables -A OUTPUT -p tcp -s 123.123.123.123/32 -m owner
> ! --uid-owner 1000 -j REJECT --reject-with tcp-reset
> iptables: Invalid argument
> 
> jimbo:/var/www# iptables -A OUTPUT -p tcp --dport 6667 -m owner !
> --uid-owner 1000 -j REJECT --reject-with tcp-reset
> iptables: Invalid argument
> 
> jimbo:/var/www# iptables -A OUTPUT -p tcp --dport 194 -m owner !
> --uid-owner \ 1235 -j REJECT --reject-with tcp-reset
> iptables: Invalid argument
> 
> So what could be wrong?

My bet would be you don't have/haven't loaded ipt_owner...  Try "insmod
ipt_owner".

j

> Thanks,
> 
> John