Re: Iptables and bridge

Re: Iptables and bridge

[Stephen Satchell]

On Tue, 2004-02-17 at 13:12, Adi wrote:
> Hi,
>  
> Does anyone ever try traffic accounting using iptables (ipac-ng) in at
> linux bridge?
> I have try using iptables -t mangle -A PREROUTING -j ACCEPT, but when
> i see the
> bytes counter using iptables -t mangle -nL -vx, it shown 0. 
> But acctually the traffic already flow from eth0,eth1and br0, 
> i monitoring by the traffic using tcpdump and iptraf.

Yes.  What I do is use accounting when I have blocked a spammer from
using mail to/from the servers behind my layer-2 firewall.  Everything
is selected by raw interface in the FILTER section.  It's been effective
to demonstrate when a person who has been guilty of spamming before is
possibly starting to spam again.

I haven't played with MANGLE in the layer-2 firewall, but then again my
whole purpose for having one of those beasts is to offload our CISCO
7500 routers and provide some very specific protection for Windows
systems.  I run a mostly-closed firewall for them, and ever since I did
that we have had far fewer problems with them.

Satch

Iptables and SNAT

[Jan Kaastrup]

Hi list
After a reboot of my RedHat mashine, the NAT part of Iptables stop
working.

I get: "iptables: Invalid argument" when using snat.

My snat rule look like this:
$IPTABLES -t nat -A POSTROUTING -o $EXT_INT -j SNAT --to-source $EXT_IP

I have made all netfilter stuff as modules.
#lsmod
ip_conntrack_irc        4336   1  (autoclean)
ip_nat_irc              3440   0  (unused)
ip_conntrack_ftp        5520   1  (autoclean)
ip_nat_ftp              4240   0  (unused)
ipt_ah                  1080   0  (unused)
ipt_esp                 1112   0  (unused)
iptable_nat            22040   2  [ip_nat_irc ip_nat_ftp]
ppp_mppe               24088   0  (autoclean)
bsd_comp                5464   0  (autoclean)
ppp_async               9440   0  (autoclean)
ppp_generic            24508   0  (autoclean) [ppp_mppe bsd_comp
ppp_async]
slhc                    6740   0  (autoclean) [ppp_generic]
ipt_LOG                 4152   1  (autoclean)
ipt_REJECT              4024   1  (autoclean)
ipt_state               1048   5  (autoclean)
iptable_mangle          2776   0  (autoclean) (unused)
ip_conntrack           28296   4  (autoclean) [ip_conntrack_irc
ip_nat_irc ip_conntrack_ftp ip_nat_ftp iptable_nat ipt_state]
iptable_filter          2412   1  (autoclean)
ip_tables              14872  10  [ipt_ah ipt_esp iptable_nat ipt_LOG
ipt_REJECT ipt_state iptable_mangle iptable_filter]

Any hints???

I have tried to recompile iptables - but nothing seems to work - I know
it did before the reboot.
Only thing that has been changed is a static route being enabled, but
this shouldn't make iptables complain:(

Thanks a lot

Re: Iptables and SNAT

[Mark Vevers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tuesday 17 Feb 2004 10:18 am, Jan Kaastrup wrote:
> Hi list
> After a reboot of my RedHat mashine, the NAT part of Iptables stop
> working.
Is the iptable_nat module loaded?  
/sbin/lsmod will list the modules and if any modules are not loaded for
the ruleset then you'll either need to modprobe them beforehand or
alter modules.conf to load them when iptables loads (add below ...)

Cheers
Mark
- -- 
Mark Vevers.    mark@ifl.net / mark@vevers.net
Principal Internet Engineer, Internet for Learning,
Research Machines Plc. (AS5503)
- --
GPG Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB08F3CA3
Fingerprint: 85BA 30C4 9EC8 1792 4C8C   C31E 58B5 3D1C B08F 3CA3
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAMfOEWLU9HLCPPKMRAu0XAJ9yVLQ0X3x0XNQ84irLTOVdZPrWUACdGr2Y
udGvM/2ukyptia+Vh/+UX6s=
=t6Ag
-----END PGP SIGNATURE-----

RE: Iptables and SNAT

[Jan Kaastrup]

Hi
Thanks for the answer.
I found out that recompiling the iptables with
KERNEL_DIR=<my-kernel-source> did the trick!


-----Original Message-----
From: Mark Vevers [mailto:mark@vevers.net] 
Sent: 17. februar 2004 15:29
To: Jan Kaastrup
Subject: Re: Iptables and SNAT


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tuesday 17 Feb 2004 11:03 am, you wrote:
> Hi
> I have iptable module loaded
Ok - are you using RedHat's IP tables?  Or have you compiled
your own and your own patch-o-matic additions?  - I've seen
problems before where people have mixed & matched. On RH
if using patch-o-matic patches and upgrading iptables to match
I uninstall the iptables rpm, compile from a vanilla kernel and
then add the patch-o-matic patches and then recompile the 
userspace apps from scratch.

BTW You need to be careful using vanilla kernels with 
multi-threaded apps on Fedora as it appears there are 
problems with fedora and a kernel which doesn't have 
NPTL support.  RH.9 seems not to mind even though the 
vanilla kernel doesn't support NPTL.

Cheers
Mark
- -- 
Mark Vevers.    mark@ifl.net / mark@vevers.net
Principal Internet Engineer, Internet for Learning,
Research Machines Plc. (AS5503)
- --
GPG Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB08F3CA3
Fingerprint: 85BA 30C4 9EC8 1792 4C8C   C31E 58B5 3D1C B08F 3CA3
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAMiUjWLU9HLCPPKMRAi0wAJ9/8W/vNs6+jP70KGtvMc8mQkOongCcCp5Y
DQnQ4zyWomkhPaW0gj26rJk=
=C7Qg
-----END PGP SIGNATURE-----

Iptables and bridge

[Adi]

[-- Attachment #1: Type: text/plain, Size: 387 bytes --]

Hi,

Does anyone ever try traffic accounting using iptables (ipac-ng) in at linux bridge?
I have try using iptables -t mangle -A PREROUTING -j ACCEPT, but when i see the
bytes counter using iptables -t mangle -nL -vx, it shown 0. 
But acctually the traffic already flow from eth0,eth1and br0, 
i monitoring by the traffic using tcpdump and iptraf.

Thanks

Regards,

Kris


[-- Attachment #2: Type: text/html, Size: 1226 bytes --]

IPtables and SNAT

[codingfreak]

Hi

I am a newbie to iptables with NAT. My network setup is as shown below


                      linuxbox2 (192.x.y.a)
                                    |
    (194.160.1.1)             |
    linuxbox1(eth1)-------- Switch ----- ftpserver
    (192.x.y.b)

BOX1 and BOX2 are in VLAN tagging via switch. BOX1 is in a VLAN tag
with FTPserver. So BOX2 inorder to connect to the FTPserver should
route via BOX1 which should has to do POSTROUTING(SNAT) and send the
FTP packets to FTPserver.

eth1 interface is configured with 2 ip-addresses one public and one
private addresses.

All the traffic from BOX2 is routed to BOX1. I added following rules
in my iptables setup present in BOX1

    $IPTABLES -t mangle -A PREROUTING -p tcp --dport 21 -s 192.x.y.a -
j ACCEPT
    $IPTABLES -t mangle -A FORWARD -p tcp --dport 21 -s 192.x.y.a -m
conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
    $IPTABLES -t nat -A POSTROUTING -s 192.x.y.a -p tcp --dport 21 -j
SNAT --to-source 194.160.1.1

If I ping from BOX2 to BOX1 it is working fine. If I try to perform
ftp to the Ftpserver then NAT table in iptables script present in BOX1
is invoked and ftp is not successfull.

If I do the tcpdump at eth1 I do see ftp packets coming from BOX2 to
BOX1 but no packets leaving from BOX1 to ftpserver.

    IP 192.x.y.a.45388 > 10.p.q.r.21(ftpserver): S
1380128644:1380128644(0)
    win 5840 <mss 1460,sackOK,timestamp 16897 0,nop,wscale 2>
    IP 192.x.y.a.45388 > 10.p.q.r.21: S 1380128644:1380128644(0)
    win 5840 <mss 1460,sackOK,timestamp 17647 0,nop,wscale 2>
    IP 192.x.y.a.45388 > 10.p.q.r.21: S 1380128644:1380128644(0)
    win 5840 <mss 1460,sackOK,timestamp 19147 0,nop,wscale 2>

Actually 3 packets are sent from BOX2 to BOX1. Counters for various
chains like prerouting, forward shows count as 3 while POSTROUTING
chain in NAT table shows a count of 1. But TCPDUMP doesnt show any
packet leaving to FTPSERVER.

So is the packet that entered the POSTROUTING chain dropped ??

**NOTE: All my IPTABLE rules should be based on ip-address but not on
interface as there is a chance of change in interface names but in ip-
addresses.**

Re: IPtables and SNAT

[Richard Horton]

>    $IPTABLES -t mangle -A PREROUTING -p tcp --dport 21 -s 192.x.y.a -
> j ACCEPT
>    $IPTABLES -t mangle -A FORWARD -p tcp --dport 21 -s 192.x.y.a -m
> conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
>    $IPTABLES -t nat -A POSTROUTING -s 192.x.y.a -p tcp --dport 21 -j
> SNAT --to-source 194.160.1.1
>


First thing to bear in mind: The mangle table is purely for packet
manipulation actions and should not be used for filtering. Move the
two accept rules into the filter table (just omit the -t mangle
parameter).

Port 21 is only the ftp control port - data uses port 20.

If you have the ftp helper try
$IPTABLES -t nat -A POSTROUTING -s 192.x.y.a -m helper --helper ftp -j
SNAT --to-source 194.160.1.1








--
Richard Horton
Users are like a virus: Each causing a thousand tiny crises until the
host finally dies.
http://www.solstans.co.uk - Solstans Japanese Bobtails and Norwegian Forest Cats
http://www.pbase.com/arimus - My online photogallery