Linux Netfilter discussions
 help / color / mirror / Atom feed
* UNTRACKED packets are identified as INVALID
@ 2008-03-26 13:29 Sharon Tal
  2008-03-26 16:42 ` Jan Engelhardt
  2008-03-27 15:38 ` Pascal Hambourg
  0 siblings, 2 replies; 4+ messages in thread
From: Sharon Tal @ 2008-03-26 13:29 UTC (permalink / raw)
  To: netfilter


Hi there,
I have 2 web servers behind an iptables based load-balancer, and I'm trying
to setup a graphics web server on the load-balancer, so that if a simple
static file is requested it will be able to respond instead of forwarding
the request to the web servers.
 
I've been trying to do that by matching packets at the raw table, setting
them to be UNTRACKED and leaving them on the LB.
The problem is that all UNTRACKED packets are identified as INVALID as soon
as they get to the mangle chain and dropped.
 
Here's my configuration (NS1, NS2 - the web servers, LB - the load balancer,
INTFACE/EXTFACE - internal/external interface)
<<--------------------------------------------------------------------------
---------------->>
echo 1 > /proc/sys/net/ipv4/ip_forward
 
$IPTABLES -F INPUT
$IPTABLES -F FORWARD
$IPTABLES -F OUTPUT
$IPTABLES -t raw  -F
$IPTABLES -t mangle -F
$IPTABLES -t nat -F
$IPTABLES -Z

# Drop invalid packets
$IPTABLES -t mangle -A PREROUTING -m state --state INVALID -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp ! --syn -m state --state NEW -j
DROP
 
# Prevent Spoofing
$IPTABLES -t mangle -A PREROUTING -i $EXTFACE -s 192.168.0.0/24 -p ! ICMP -j
DROP
 
# Prevent Smurf Attacks
$IPTABLES -t mangle -A PREROUTING -p icmp -i $EXTFACE -d 192.168.0.255 -j
DROP
 
# Prevent Syn-Flood, Ping-O-Death & Fast Port Scanning
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
$IPTABLES -t mangle -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

# Limit number of new connections/second from a single IP to a single port
$IPTABLES -t mangle -A PREROUTING -i $EXTFACE -p tcp --dport 80 -m state
--state NEW -m recent --name HTTP --set
$IPTABLES -t mangle -A PREROUTING -i $EXTFACE -p tcp --dport 80 -m state
--state NEW -m recent --name HTTP --update --seconds 2 --hitcount 100 -j
DROP

# Forward traffic from internal servers to the internet
$IPTABLES -t nat -A POSTROUTING -o $EXTFACE -j SNAT --to-source
192.168.100.153

# JPG requests should be answered by LB
$IPTABLES -t raw -A PREROUTING -i $EXTFACE -p tcp --dport 80 -m string
--algo bm --string "GET /" -m string --algo bm --string ".jpg HTTP/1." -j
NOTRACK
$IPTABLES -t mangle -A PREROUTING -i $EXTFACE -p tcp --dport 80 -m state
--state UNTRACKED -j MARK --set-mark 0x11

# HTTP (25:75 Marking 1X)
$IPTABLES -t mangle -A PREROUTING -i $EXTFACE -p tcp --dport 80 -m mark
--mark 0x0 -m statistic --mode nth --every 4 -j MARK --set-mark 0x12
$IPTABLES -t mangle -A PREROUTING -i $EXTFACE -p tcp --dport 80 -m mark
--mark 0x0 -j MARK --set-mark 0x13
$IPTABLES -t mangle -A PREROUTING -i $EXTFACE -p tcp --dport 80 -j RETURN
$IPTABLES -t nat -A PREROUTING -i $EXTFACE -p tcp --dport 80 -m mark --mark
0x12 -j DNAT --to-destination $NS1IP:80
$IPTABLES -t nat -A PREROUTING -i $EXTFACE -p tcp --dport 80 -m mark --mark
0x13 -j DNAT --to-destination $NS2IP:80
$IPTABLES -t nat -A PREROUTING -i $EXTFACE -p tcp --dport 80 -m mark --mark
0x0 -j DNAT --to-destination $NS2IP:80
$IPTABLES -t nat -A PREROUTING -i $EXTFACE -p tcp --dport 80 -j RETURN
<<--------------------------------------------------------------------------
---------------->>
 
Any ideas on how to make this happen or what am I doing wrong?
 
Thanks!
 
Cheers!


^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2008-03-30  9:55 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-03-26 13:29 UNTRACKED packets are identified as INVALID Sharon Tal
2008-03-26 16:42 ` Jan Engelhardt
2008-03-27 15:38 ` Pascal Hambourg
2008-03-30  9:55   ` Sharon Tal

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox