From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Adi" Subject: Iptables and bridge Date: Tue, 17 Feb 2004 13:12:19 -0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <003001c3f59a$ba6dc2b0$15a02bca@Rangga> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_002D_01C3F557.AC3CC710" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter This is a multi-part message in MIME format. ------=_NextPart_000_002D_01C3F557.AC3CC710 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, Does anyone ever try traffic accounting using iptables (ipac-ng) in at = linux bridge? I have try using iptables -t mangle -A PREROUTING -j ACCEPT, but when i = see the bytes counter using iptables -t mangle -nL -vx, it shown 0.=20 But acctually the traffic already flow from eth0,eth1and br0,=20 i monitoring by the traffic using tcpdump and iptraf. Thanks Regards, Kris ------=_NextPart_000_002D_01C3F557.AC3CC710 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi,

Does anyone ever try traffic accounting = using=20 iptables (ipac-ng) in at linux bridge?

I have try using iptables -t mangle -A = PREROUTING=20 -j ACCEPT, but when i see the

bytes counter using iptables -t mangle = -nL -vx, it=20 shown 0.

But acctually the traffic already flow = from eth0,eth1and br0,

i monitoring by the traffic using = tcpdump and=20 iptraf.

Thanks

Regards,

Kris

------=_NextPart_000_002D_01C3F557.AC3CC710-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Satchell Subject: Re: Iptables and bridge Date: Mon, 16 Feb 2004 22:55:17 -0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1077000917.9435.6.camel@ssatchell1.pyramid.net> References: <003001c3f59a$ba6dc2b0$15a02bca@Rangga> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <003001c3f59a$ba6dc2b0$15a02bca@Rangga> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Adi Cc: netfilter On Tue, 2004-02-17 at 13:12, Adi wrote: > Hi, > > Does anyone ever try traffic accounting using iptables (ipac-ng) in at > linux bridge? > I have try using iptables -t mangle -A PREROUTING -j ACCEPT, but when > i see the > bytes counter using iptables -t mangle -nL -vx, it shown 0. > But acctually the traffic already flow from eth0,eth1and br0, > i monitoring by the traffic using tcpdump and iptraf. Yes. What I do is use accounting when I have blocked a spammer from using mail to/from the servers behind my layer-2 firewall. Everything is selected by raw interface in the FILTER section. It's been effective to demonstrate when a person who has been guilty of spamming before is possibly starting to spam again. I haven't played with MANGLE in the layer-2 firewall, but then again my whole purpose for having one of those beasts is to offload our CISCO 7500 routers and provide some very specific protection for Windows systems. I run a mostly-closed firewall for them, and ever since I did that we have had far fewer problems with them. Satch From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jan Kaastrup" Subject: Iptables and SNAT Date: Tue, 17 Feb 2004 11:18:56 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <004d01c3f53f$73685cf0$2d64a8c0@pcjka> References: <1077000917.9435.6.camel@ssatchell1.pyramid.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1077000917.9435.6.camel@ssatchell1.pyramid.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'netfilter' Hi list After a reboot of my RedHat mashine, the NAT part of Iptables stop working. I get: "iptables: Invalid argument" when using snat. My snat rule look like this: $IPTABLES -t nat -A POSTROUTING -o $EXT_INT -j SNAT --to-source $EXT_IP I have made all netfilter stuff as modules. #lsmod ip_conntrack_irc 4336 1 (autoclean) ip_nat_irc 3440 0 (unused) ip_conntrack_ftp 5520 1 (autoclean) ip_nat_ftp 4240 0 (unused) ipt_ah 1080 0 (unused) ipt_esp 1112 0 (unused) iptable_nat 22040 2 [ip_nat_irc ip_nat_ftp] ppp_mppe 24088 0 (autoclean) bsd_comp 5464 0 (autoclean) ppp_async 9440 0 (autoclean) ppp_generic 24508 0 (autoclean) [ppp_mppe bsd_comp ppp_async] slhc 6740 0 (autoclean) [ppp_generic] ipt_LOG 4152 1 (autoclean) ipt_REJECT 4024 1 (autoclean) ipt_state 1048 5 (autoclean) iptable_mangle 2776 0 (autoclean) (unused) ip_conntrack 28296 4 (autoclean) [ip_conntrack_irc ip_nat_irc ip_conntrack_ftp ip_nat_ftp iptable_nat ipt_state] iptable_filter 2412 1 (autoclean) ip_tables 14872 10 [ipt_ah ipt_esp iptable_nat ipt_LOG ipt_REJECT ipt_state iptable_mangle iptable_filter] Any hints??? I have tried to recompile iptables - but nothing seems to work - I know it did before the reboot. Only thing that has been changed is a static route being enabled, but this shouldn't make iptables complain:( Thanks a lot From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark Vevers Subject: Re: Iptables and SNAT Date: Tue, 17 Feb 2004 10:57:04 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200402171057.08738.mark@vevers.net> References: <004d01c3f53f$73685cf0$2d64a8c0@pcjka> Reply-To: mark@vevers.net Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <004d01c3f53f$73685cf0$2d64a8c0@pcjka> Content-Description: clearsigned data Content-Disposition: inline Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: Text/Plain; charset="us-ascii" To: Jan Kaastrup , 'netfilter' =2D----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday 17 Feb 2004 10:18 am, Jan Kaastrup wrote: > Hi list > After a reboot of my RedHat mashine, the NAT part of Iptables stop > working. Is the iptable_nat module loaded? =20 /sbin/lsmod will list the modules and if any modules are not loaded for the ruleset then you'll either need to modprobe them beforehand or alter modules.conf to load them when iptables loads (add below ...) Cheers Mark =2D --=20 Mark Vevers. mark@ifl.net / mark@vevers.net Principal Internet Engineer, Internet for Learning, Research Machines Plc. (AS5503) =2D -- GPG Key: http://pgp.mit.edu:11371/pks/lookup?op=3Dget&search=3D0xB08F3CA3 =46ingerprint: 85BA 30C4 9EC8 1792 4C8C C31E 58B5 3D1C B08F 3CA3 =2D----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFAMfOEWLU9HLCPPKMRAu0XAJ9yVLQ0X3x0XNQ84irLTOVdZPrWUACdGr2Y udGvM/2ukyptia+Vh/+UX6s=3D =3Dt6Ag =2D----END PGP SIGNATURE----- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jan Kaastrup" Subject: RE: Iptables and SNAT Date: Tue, 17 Feb 2004 15:39:37 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000001c3f563$de6ba5b0$2d64a8c0@pcjka> References: <200402171428.52966.mark@vevers.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200402171428.52966.mark@vevers.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: mark@vevers.net Cc: netfilter@lists.netfilter.org Hi Thanks for the answer. I found out that recompiling the iptables with KERNEL_DIR= did the trick! -----Original Message----- From: Mark Vevers [mailto:mark@vevers.net] Sent: 17. februar 2004 15:29 To: Jan Kaastrup Subject: Re: Iptables and SNAT -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday 17 Feb 2004 11:03 am, you wrote: > Hi > I have iptable module loaded Ok - are you using RedHat's IP tables? Or have you compiled your own and your own patch-o-matic additions? - I've seen problems before where people have mixed & matched. On RH if using patch-o-matic patches and upgrading iptables to match I uninstall the iptables rpm, compile from a vanilla kernel and then add the patch-o-matic patches and then recompile the userspace apps from scratch. BTW You need to be careful using vanilla kernels with multi-threaded apps on Fedora as it appears there are problems with fedora and a kernel which doesn't have NPTL support. RH.9 seems not to mind even though the vanilla kernel doesn't support NPTL. Cheers Mark - -- Mark Vevers. mark@ifl.net / mark@vevers.net Principal Internet Engineer, Internet for Learning, Research Machines Plc. (AS5503) - -- GPG Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB08F3CA3 Fingerprint: 85BA 30C4 9EC8 1792 4C8C C31E 58B5 3D1C B08F 3CA3 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFAMiUjWLU9HLCPPKMRAi0wAJ9/8W/vNs6+jP70KGtvMc8mQkOongCcCp5Y DQnQ4zyWomkhPaW0gj26rJk= =C7Qg -----END PGP SIGNATURE----- From mboxrd@z Thu Jan 1 00:00:00 1970 From: codingfreak Subject: IPtables and SNAT Date: Mon, 26 Oct 2009 22:08:32 -0700 (PDT) Message-ID: References: <95ac437a-3f19-490a-80d0-3ce0a20850ed@y10g2000prg.googlegroups.com> <46ee7b1c0910212155pd99519cw9831d4bb7d7f3064@mail.gmail.com> Mime-Version: 1.0 Return-path: In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: codingfreak Cc: netfilter@vger.kernel.org Hi I am a newbie to iptables with NAT. My network setup is as shown below linuxbox2 (192.x.y.a) | (194.160.1.1) | linuxbox1(eth1)-------- Switch ----- ftpserver (192.x.y.b) BOX1 and BOX2 are in VLAN tagging via switch. BOX1 is in a VLAN tag with FTPserver. So BOX2 inorder to connect to the FTPserver should route via BOX1 which should has to do POSTROUTING(SNAT) and send the FTP packets to FTPserver. eth1 interface is configured with 2 ip-addresses one public and one private addresses. All the traffic from BOX2 is routed to BOX1. I added following rules in my iptables setup present in BOX1 $IPTABLES -t mangle -A PREROUTING -p tcp --dport 21 -s 192.x.y.a - j ACCEPT $IPTABLES -t mangle -A FORWARD -p tcp --dport 21 -s 192.x.y.a -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT $IPTABLES -t nat -A POSTROUTING -s 192.x.y.a -p tcp --dport 21 -j SNAT --to-source 194.160.1.1 If I ping from BOX2 to BOX1 it is working fine. If I try to perform ftp to the Ftpserver then NAT table in iptables script present in BOX1 is invoked and ftp is not successfull. If I do the tcpdump at eth1 I do see ftp packets coming from BOX2 to BOX1 but no packets leaving from BOX1 to ftpserver. IP 192.x.y.a.45388 > 10.p.q.r.21(ftpserver): S 1380128644:1380128644(0) win 5840 IP 192.x.y.a.45388 > 10.p.q.r.21: S 1380128644:1380128644(0) win 5840 IP 192.x.y.a.45388 > 10.p.q.r.21: S 1380128644:1380128644(0) win 5840 Actually 3 packets are sent from BOX2 to BOX1. Counters for various chains like prerouting, forward shows count as 3 while POSTROUTING chain in NAT table shows a count of 1. But TCPDUMP doesnt show any packet leaving to FTPSERVER. So is the packet that entered the POSTROUTING chain dropped ?? **NOTE: All my IPTABLE rules should be based on ip-address but not on interface as there is a chance of change in interface names but in ip- addresses.** From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Horton Subject: Re: IPtables and SNAT Date: Tue, 27 Oct 2009 09:03:08 +0000 Message-ID: <56378e320910270203i5ab08ec3gd48d1283b4f37bac@mail.gmail.com> References: <95ac437a-3f19-490a-80d0-3ce0a20850ed@y10g2000prg.googlegroups.com> <46ee7b1c0910212155pd99519cw9831d4bb7d7f3064@mail.gmail.com>

Mime-Version: 1.0 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:mime-version:sender:received:in-reply-to :references:date:x-google-sender-auth:message-id:subject:from:to:cc :content-type:content-transfer-encoding; bh=NM1HbGqeZDUGnA5ZOxr9B4DDC9NwCWmpMIL30CWgzQY=; b=iSluMiHL6X/umzTayYMBhV3B0zfcCfTury4nyuWMxqYTiZHw1lbbaOZG4HgU8YT9Ff u5rwUY7+d63cLlSNpkVEE4GEyMufIKZ54Rke4ZRSiPfzaV9mvAlrX7VlFM/r1EF//6YO L3R8rdsG2ASx0c5LoWucHezMV1Z94/1LPNCLg= In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="iso-8859-1" To: codingfreak Cc: netfilter@vger.kernel.org > =A0 =A0$IPTABLES -t mangle -A PREROUTING -p tcp --dport 21 -s 192.x.y= =2Ea - > j ACCEPT > =A0 =A0$IPTABLES -t mangle -A FORWARD -p tcp --dport 21 -s 192.x.y.a = -m > conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT > =A0 =A0$IPTABLES -t nat -A POSTROUTING -s 192.x.y.a -p tcp --dport 21= -j > SNAT --to-source 194.160.1.1 > =46irst thing to bear in mind: The mangle table is purely for packet manipulation actions and should not be used for filtering. Move the two accept rules into the filter table (just omit the -t mangle parameter). Port 21 is only the ftp control port - data uses port 20. If you have the ftp helper try $IPTABLES -t nat -A POSTROUTING -s 192.x.y.a -m helper --helper ftp -j SNAT --to-source 194.160.1.1 -- Richard Horton Users are like a virus: Each causing a thousand tiny crises until the host finally dies. http://www.solstans.co.uk - Solstans Japanese Bobtails and Norwegian Fo= rest Cats http://www.pbase.com/arimus - My online photogallery