Can iptables do this?

Can iptables do this?

[eduardg]

Hi,

I want to built a network that allows http navigation to any host that is 
plugged on it, without any change on its configuration.

For example my network is 1.2.3.0 and I want that a host with an IP address 
10.9.8.7 can navigate. First of all, the host will send arp request to find the 
MAC of its DNS server (I'll have to redirect it to my DNS), then it will look 
for its default gateway, etc (I can't work with mobile IP nor change any host 
configuration).

Not any host is allowed to do this, only hosts with known MACs.


Has anybody implemented a solution for a similar challenge? Any idea?

Thank you in advance.


Edu

Re: Can iptables do this?

[eduardg]

Hi, first of all thank you for your time

Missatge citat per: Antony Stone <Antony@Soft-Solutions.co.uk>:

> On Monday 20 May 2002 1:03 pm, Eduardo GARCIA wrote:
> 
> > For example my network is 1.2.3.0 and I want that a host with an IP
> address
> > 10.9.8.7 can navigate. First of all, the host will send arp request to
> find
> > the MAC of its DNS server (I'll have to redirect it to my DNS), then
> it
> > will look for its default gateway, etc (I can't work with mobile IP
> nor
> > change any host configuration).
> >
> > Not any host is allowed to do this, only hosts with known MACs.

Here comes (I belive) iptables



> 
> Sounds like you want BOOTP / DHCP ?

No, this way the network configuration dynamically changes.


> 
> I don't quite see where IPtables comes into this.... ?


I have to translate the ip of the host, but the problem comes when the host 
tries to find its DNS, it first has to send an ARP request that must be 
responsed by somebody on my network. Is possible to mangle an arp request to 
change dest ip?


> 
> 
> 
> Antony.
> 
> 

Re: can iptables do this?

[Sven Koch]

On Tue, 21 May 2002, Antony Stone wrote:

> On Tuesday 21 May 2002 10:47 am, Eduardo GARCIA wrote:
> > For example my network is 1.2.3.0 and I want that a host with an IP from
> > any unknown network (i. e. 10.9.8.7) can navigate.
>
> No way.   You can't create a network which will allow a host with some
> arbitrary preset IP address (and gateway, and DNS...) to come along an plug
> into - for two reasons:

You can, at least one commercial device does right that - see
www.nomadix.com for ther usg (universal subscriber gateway).

It seems to be some kind of "answer to every arp request" combined with
nat - won't be easy, but it should be doable with iptables and some
home-grown programs.

c'ya
sven

-- 

The Internet treats censorship as a routing problem, and routes around it.
(John Gilmore on http://www.cygnus.com/~gnu/)

Re: can iptables do this?

[Edu]

Thank you all for your time, I'll have to squeeze hard my brain to solve it.

Just one more question: I've heard that there is a Cisco system (just one
machine that solves the whole problem?) that allows all that thing. Anybody
knows it?


Thanks again.


Edu

Re: can iptables do this?

[Antony Stone]

On Tuesday 21 May 2002 1:27 pm, Sven Koch wrote:

> On Tue, 21 May 2002, Antony Stone wrote:
> > On Tuesday 21 May 2002 10:47 am, Eduardo GARCIA wrote:
> > > For example my network is 1.2.3.0 and I want that a host with an IP
> > > from any unknown network (i. e. 10.9.8.7) can navigate.
> >
> > No way.   You can't create a network which will allow a host with some
> > arbitrary preset IP address (and gateway, and DNS...) to come along an
> > plug into - for two reasons:
>
> You can, at least one commercial device does right that - see
> www.nomadix.com for ther usg (universal subscriber gateway).
>
> It seems to be some kind of "answer to every arp request" combined with
> nat - won't be easy, but it should be doable with iptables and some
> home-grown programs.

I still maintain that this method won't work for all cases (although I could 
see that it might cover the majority of IP addresses).

Suppose, for example, that I work for Hewlett-Packard, who have a Class A 
network on address 15.0.0.0/255.0.0.0

Then my PC will have an address somewhere in this range (remember we're not 
using DHCP here, so I must have a static address), and it will consider all 
other addresses in this range as local, not to be routed through a gateway.

Then if I take this machine and plug it into the network described above, and 
I assume that it handles all the arp requests very cleverly, it's still going 
to allow me to access anything on the Internet except my 'own' local network, 
15.0.0.0/255.0.0.0, which is actually quite a likely one for me to want to 
contact whilst I'm out and about.....

The reason I think I won't be able to access my 'own' network is because my 
machine will expect to find 15.x.y.z servers locally, not through any router, 
therefore it's going to look for machines on the local net, not through the 
gateway it magically discovers through all this arp nonsense....

Anybody explain where my reasoning falls down so this crazy scheme *can* 
actually work ?

 

Antony.

Can iptables do this ?

[Ramoni]

Hi,
can iptables do a temp rule ?
I mean, I need to create rules that will be deleted after x seconds or minutes.
The time module does not remove the rules as it is not supposed to do so.
Is there a module that I could say:
iptables -I FORWARD -s a.b.c.d -j DROP -m xxxxx --minutes 2
and the rule will be deleted after 2 minutes os something like that ?

thanx

Re: Can iptables do this ?

[Antony Stone]

On Friday 02 January 2004 7:07 pm, Ramoni wrote:

> Hi,
> can iptables do a temp rule ?
> I mean, I need to create rules that will be deleted after x seconds or
> minutes. The time module does not remove the rules as it is not supposed to
> do so. Is there a module that I could say:
> iptables -I FORWARD -s a.b.c.d -j DROP -m xxxxx --minutes 2
> and the rule will be deleted after 2 minutes os something like that ?

No.

Use cron, at, or sleep.

Antony.

-- 
Your work is both good and original.  Unfortunately the parts that are good 
aren't original, and the parts that are original aren't good.

 - Samuel Johnson

                                                     Please reply to the list;
                                                           please don't CC me.