Linux Netfilter discussions
 help / color / mirror / Atom feed
* icmp echo reply && FORWARD chain
@ 2004-05-02 14:24 Jee J.Z.
  2004-05-02 14:46 ` Antony Stone
  0 siblings, 1 reply; 6+ messages in thread
From: Jee J.Z. @ 2004-05-02 14:24 UTC (permalink / raw)
  To: netfilter

Hi all,

My rules on a gateway linux box (PC2) are set as follows:

Internet(PC1 and so on)-----------(eth0)-PC2-(eth1)-------------Internal
networks(PC3 and so on...)

iptables -F
iptables -F -t nat
iptables -I FORWARD -j QUEUE
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.2

ICMP echo request packets from PC1 or PC3 to PC2 can be caught by the
FORWARD chain queuing to userspace, however, ICMP echo reply (in response to
ping request from PC2) packets from PC1 or PC3 to PC2 will be ignored by the
FORWARD chain. Is this a reasonable phenomenon? Could anyone tell me the
reasons? Thanks a lot in advance!

Cheers,
Jee



^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: icmp echo reply && FORWARD chain
  2004-05-02 14:24 icmp echo reply && FORWARD chain Jee J.Z.
@ 2004-05-02 14:46 ` Antony Stone
  2004-05-02 15:29   ` Jee J.Z.
  0 siblings, 1 reply; 6+ messages in thread
From: Antony Stone @ 2004-05-02 14:46 UTC (permalink / raw)
  To: netfilter

On Sunday 02 May 2004 3:24 pm, Jee J.Z. wrote:

> Hi all,
>
> My rules on a gateway linux box (PC2) are set as follows:
>
> Internet(PC1 and so on)-----------(eth0)-PC2-(eth1)-------------Internal
> networks(PC3 and so on...)
>
> iptables -F
> iptables -F -t nat
> iptables -I FORWARD -j QUEUE
> iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
> iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.2

That is a weird-looking rule.   Where does IP 192.168.0.2 exist on the above 
diagram?

> ICMP echo request packets from PC1 or PC3 to PC2 can be caught by the
> FORWARD chain queuing to userspace, however, ICMP echo reply (in response
> to ping request from PC2) packets from PC1 or PC3 to PC2 will be ignored by
> the FORWARD chain. Is this a reasonable phenomenon? Could anyone tell me
> the reasons? Thanks a lot in advance!
>
> Cheers,
> Jee

-- 
Ramdisk is not an installation procedure.

                                                     Please reply to the list;
                                                           please don't CC me.



^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: icmp echo reply && FORWARD chain
  2004-05-02 14:46 ` Antony Stone
@ 2004-05-02 15:29   ` Jee J.Z.
  2004-05-02 15:42     ` Antony Stone
  0 siblings, 1 reply; 6+ messages in thread
From: Jee J.Z. @ 2004-05-02 15:29 UTC (permalink / raw)
  To: netfilter

Hi Antony,

Sorry for the confusion.

> On Sunday 02 May 2004 3:24 pm, Jee J.Z. wrote:
>
> > Hi all,
> >
> > My rules on a gateway linux box (PC2) are set as follows:
> >
> > Internet(PC1 and so
on)-----------(eth0:global_ip)-PC2-(eth1:192.168.0.1)-------------Internal
> > networks(PC3(192.168.0.2) and so on...)
> >
> > iptables -F
> > iptables -F -t nat
> > iptables -I FORWARD -j QUEUE
> > iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
> > iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.2
>
> That is a weird-looking rule.   Where does IP 192.168.0.2 exist on the
above
> diagram?

It's the internal IP of PC3. I modified the diagram a little bit. Thank you.

Jee


> > ICMP echo request packets from PC1 or PC3 to PC2 can be caught by the
> > FORWARD chain queuing to userspace, however, ICMP echo reply (in
response
> > to ping request from PC2) packets from PC1 or PC3 to PC2 will be ignored
by
> > the FORWARD chain. Is this a reasonable phenomenon? Could anyone tell me
> > the reasons? Thanks a lot in advance!
> >
> > Cheers,
> > Jee
>
> -- 
> Ramdisk is not an installation procedure.
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>
>



^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: icmp echo reply && FORWARD chain
  2004-05-02 15:29   ` Jee J.Z.
@ 2004-05-02 15:42     ` Antony Stone
  2004-05-02 22:43       ` Jee J.Z.
  0 siblings, 1 reply; 6+ messages in thread
From: Antony Stone @ 2004-05-02 15:42 UTC (permalink / raw)
  To: netfilter

On Sunday 02 May 2004 4:29 pm, Jee J.Z. wrote:

> Hi Antony,
>
> Sorry for the confusion.
>
> > > My rules on a gateway linux box (PC2) are set as follows:
> > >
> > > Internet (PC1 and so on)
> > >   |
> > >   |
> > > (eth0:global_ip)
> > > PC2
> > > (eth1:192.168.0.1)
> > >   |
> > >   |
> > > Internal networks (PC3 (192.168.0.2) and so on...)
> > >
> > > iptables -F
> > > iptables -F -t nat
> > > iptables -I FORWARD -j QUEUE
> > > iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
> > > iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.2
> >
> > That is a weird-looking rule.   Where does IP 192.168.0.2 exist on the
> > above diagram?
>
> It's the internal IP of PC3. I modified the diagram a little bit. Thank you.

I modified it a bit too, so we don't have problems with line-wrap.

So, what you're saying is that any packet coming in on eth1, addressed to 
anywhere at all, gets DNATted, and sent straight back out eth1 again, now 
addressed to PC3.   Hm.

Why?

Antony.

PS: I'm not sure if the sig below (which gets selected at random by my mail 
client) is appropriate here, however I can't see it doing any harm to remind 
people :)

-- 
90% of networking problems are routing problems.
9 of the remaining 10% are routing problems in the other direction.
The remaining 1% might be something else, but check the routing anyway.

                                                     Please reply to the list;
                                                           please don't CC me.



^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: icmp echo reply && FORWARD chain
  2004-05-02 15:42     ` Antony Stone
@ 2004-05-02 22:43       ` Jee J.Z.
  2004-05-02 23:03         ` Antony Stone
  0 siblings, 1 reply; 6+ messages in thread
From: Jee J.Z. @ 2004-05-02 22:43 UTC (permalink / raw)
  To: netfilter

Hi Antony,

Oh, dear! I am making a lot ot mistakes. The rules are as follows:

iptables -F
iptables -F -t nat
iptables -I FORWARD -j QUEUE
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 192.168.0.2

The problem is that it seems icmp request destined to PC2 can be caught by
the FORWARD chain, however, the icmp reply destined to PC2 is ignored by the
FORWARD chain.

Sorry again,
Jee

PS, however, you remind me a kind of setup to make traffic bouncing back to
the same subnet.:p


> On Sunday 02 May 2004 4:29 pm, Jee J.Z. wrote:
>
> > Hi Antony,
> >
> > Sorry for the confusion.
> >
> > > > My rules on a gateway linux box (PC2) are set as follows:
> > > >
> > > > Internet (PC1 and so on)
> > > >   |
> > > >   |
> > > > (eth0:global_ip)
> > > > PC2
> > > > (eth1:192.168.0.1)
> > > >   |
> > > >   |
> > > > Internal networks (PC3 (192.168.0.2) and so on...)
> > > >
> > > > iptables -F
> > > > iptables -F -t nat
> > > > iptables -I FORWARD -j QUEUE
> > > > iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
> > > > iptables -t nat -A PREROUTING -i eth1 -j DNAT --to 192.168.0.2
> > >
> > > That is a weird-looking rule.   Where does IP 192.168.0.2 exist on the
> > > above diagram?
> >
> > It's the internal IP of PC3. I modified the diagram a little bit. Thank
you.
>
> I modified it a bit too, so we don't have problems with line-wrap.
>
> So, what you're saying is that any packet coming in on eth1, addressed to
> anywhere at all, gets DNATted, and sent straight back out eth1 again, now
> addressed to PC3.   Hm.
>
> Why?
>
> Antony.
>
> PS: I'm not sure if the sig below (which gets selected at random by my
mail
> client) is appropriate here, however I can't see it doing any harm to
remind
> people :)
>
> -- 
> 90% of networking problems are routing problems.
> 9 of the remaining 10% are routing problems in the other direction.
> The remaining 1% might be something else, but check the routing anyway.
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>
>



^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: icmp echo reply && FORWARD chain
  2004-05-02 22:43       ` Jee J.Z.
@ 2004-05-02 23:03         ` Antony Stone
  0 siblings, 0 replies; 6+ messages in thread
From: Antony Stone @ 2004-05-02 23:03 UTC (permalink / raw)
  To: netfilter

On Sunday 02 May 2004 11:43 pm, Jee J.Z. wrote:

> Hi Antony,
>
> Oh, dear! I am making a lot ot mistakes. The rules are as follows:
>
> iptables -F
> iptables -F -t nat
> iptables -I FORWARD -j QUEUE
> iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to global_ip
> iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 192.168.0.2
>
> The problem is that it seems icmp request destined to PC2 can be caught by
> the FORWARD chain, however, the icmp reply destined to PC2 is ignored by
> the FORWARD chain.

This may seem like a strange suggestion (however, it seems you are trying to 
do something quite strange, I think...), but try putting the QUEUE target 
into the mangle table instead of the filter table (mangle tables generally 
see more packets than filter tables, because nothing 'magic' happens in the 
background, causing packets to bypass them, which is the case with filter 
tables and nat tables):

iptables -A FORWARD -t mangle -j QUEUE

Regards,

Antony.

-- 
The idea that Bill Gates appeared like a knight in shining armour to lead all 
customers out of a mire of technological chaos neatly ignores the fact that 
it was he who, by peddling second-rate technology, led them into it in the 
first place.

 - Douglas Adams in The Guardian, 25th August 1995

                                                     Please reply to the list;
                                                           please don't CC me.



^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2004-05-02 23:03 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-05-02 14:24 icmp echo reply && FORWARD chain Jee J.Z.
2004-05-02 14:46 ` Antony Stone
2004-05-02 15:29   ` Jee J.Z.
2004-05-02 15:42     ` Antony Stone
2004-05-02 22:43       ` Jee J.Z.
2004-05-02 23:03         ` Antony Stone

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox