Re: IP Alias with iptables

Re: IP Alias with iptables

[Antony Stone]

On Monday 19 April 2004 4:41 pm, Rodrigo Haces wrote:

> Hi:
>
> I have only one network adapter in my Server, but i need to have 2
> different networks, 192.168.1.0 to the MAC addresses i know and 192.168.0.0
> to the MAC addresses i don't know

This sounds strange - what is your network layout, giving rise to machines 
with "MAC addresses you don't know", which need you to be on a different 
subnet?

> i have managed this by makin mi eth0 to
> 192.168.1.1 and an alias eth0:0 to 192.168.0.1, everythings ok, but i'm
> also sharing internet, but when i start the rule to the eth0:0 it sends me
> an error. Is there a way to use IP Aliasing with iptables?

Yes - just remember that there's only one physical interface, and it's called 
eth0.   Don't try to use :0 or :1 in your netfilter rules.   You can always 
use -s or -d to specify source & destination IP addresses if you want the 
rule/s to apply only to certain packets.

> if not, is there a way to create an eth0 and eth1 witn the same adapter?

No.   It's a simple (and cheap) job to add another ethernet card, though.

Regards,

Antony.

-- 
All matter in the Universe can be placed into one of two categories:

1. Things which need to be fixed.
2. Things which need to be fixed once you've had a few minutes to play with 
them.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: IP Alias with iptables

[Michael Gale]

Hello,

	eth0:0 is an alias to eth0 -- so in iptables you must reference the interface
(eth0) and they also go by destination (-d) 

So in the following example:
eth0 = 192.168.0.1
eth0:0 = 10.10.0.1

iptables -A INPUT -i eth0 -d 192.168.0.1 -p tcp --dport 80 -j ACCEPT

will allow port 80 for the 192.168.0.1 network and

iptables -A INPUT -i eth0 -d 10.10.0.1 -p tcp --dport 25 -j ACCEPT 

will allow mail for the 10.10.0.1 network.

Michael.


On Mon, 19 Apr 2004 09:41:44 -0600
"Rodrigo Haces" <rhaces_chistes@yahoo.com.mx> wrote:

> Hi:
> 
> I have only one network adapter in my Server, but i need to have 2 different
> networks, 192.168.1.0 to the MAC addresses i know and 192.168.0.0 to the MAC
> addresses i dont't know, i have managed this by makin mi eth0 to 192.168.1.1
> and an alias eth0:0 to 192.168.0.1, everythings ok, but i'm also sharing
> internet, but when i start the rule to the eth0:0 it sends me an error. Is
> there a way to use IP Aliasing with iptables? if not, is there a way to
> create an eth0 and eth1 witn the same adapter?
> 
> Thanks
> 
> Rodrigo
> 
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: IP Alias with iptables

[Antony Stone]

On Monday 19 April 2004 5:07 pm, Rodrigo Haces wrote:

> > > I have only one network adapter in my Server, but i need to have 2
> > > different networks, 192.168.1.0 to the MAC addresses i know and
> > > 192.168.0.0 to the MAC addresses i don't know
> >
> > This sounds strange - what is your network layout, giving rise to
> > machines with "MAC addresses you don't know", which need you to be on a
> > different subnet?
>
> Ok, this is what i want, i have a Restaurant, and have an administrative
> network (192.168.1.0) and i am giving wireless access to my clients, but i
> cant let them get into my administrative network, so i set them
> 192.168.0.0.

I would *really* recommend that you have two physically separate subnets for 
this.   Otherwise there is nothing to stop someone using a wireless sniffer 
to see all the traffic on your administrative network.

> > > i have managed this by makin mi eth0 to
> > > 192.168.1.1 and an alias eth0:0 to 192.168.0.1, everythings ok, but i'm
> > > also sharing internet, but when i start the rule to the eth0:0 it sends
> > > me an error. Is there a way to use IP Aliasing with iptables?
> >
> > Yes - just remember that there's only one physical interface, and
> > it's called eth0.   Don't try to use :0 or :1 in your netfilter rules.
> > You can always use -s or -d to specify source & destination IP addresses
> > if you want the rule/s to apply only to certain packets.
>
> ok, this are my rules, where and how do i use the -d and -s??
>
> echo "   FWD: Allow all connections OUT and only existing and related ones
> IN"
> iptables -A FORWARD -i ppp0 -o eth0 -m state --state ESTABLISHED,RELATED -j
> ACCEPT
> iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
> echo "   Enabling SNAT (MASQUERADE) functionality on ppp0"
> iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

I can't answer your question properly because you haven't said what you want 
to allow and what you want to block (based on address, because you can't base 
it on interface name), however if for example you wanted to allow Internet 
access from network 192.168.0.0/24 and not allow it from 192.168.1.0/24, then 
you could use -s and -d like this:

iptables -A POSTROUTING -o ppp0 -s 192.168.0.0/24 -j MASQUERADE
iptables -A FORWARD -i eth0 -o ppp0 -s 192.168.0.0/24 -j ACCEPT
iptables -A FORWARD -i ppp0 -o eth0 -d 192.168.0.0/24 -m state --state 
ESTABLISHED,RELATED -j ACCEPT

I'm sure this gives you the idea of what I mean - simply adjust depending on 
which network range you want to do what.

> > > if not, is there a way to create an eth0 and eth1 witn the same
> > > adapter?
> >
> > No.   It's a simple (and cheap) job to add another ethernet card, though.
>
> No PCI slots available... :(

I suggest another firewall then - trying to set up a firewall with only one 
ethernet interface is a poor enough solution (from a security point of view) 
in the first place, but if there is wireless access involved as well then I 
would not even consider it.

Regards,

Antony.

-- 
"There has always been an underlying argument that we should open up our 
source code more broadly. The fact is that we are learning from open source 
and we are opening our code more broadly through Shared Source.

Is there value to providing source code? The answer is unequivocally yes."

 - Jason Matusow, head of Microsoft's Shared Source Program, in response to 
recent leaks of Windows source code on the Internet.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: IP Alias with iptables

[Alexis]

in my case, i prefer to use a script made by myself and call it by a
rc.local or using a sysv script.

Im not shure if adding a new IPADDR will work, because you need iproute2 to
achieve what i told you.

Just try and let us know :)



----- Original Message ----- 
From: "Rodrigo Haces" <rhaces_chistes@yahoo.com.mx>
To: <netfilter@lists.netfilter.org>
Sent: Monday, April 19, 2004 1:20 PM
Subject: RE: IP Alias with iptables


>
>
> > Enviado el: Lunes, 19 de Abril de 2004 08:53 a.m.
> >
> > why not to use iproute2 adding a new ip address to the interface
> > and filter
> > with the source?
> >
> > like
> >
> > ip add add 192.168.0.1/24 dev eth0
> > ip add add 192.168.1.1/24 dev eth0
> >
> > and then apply the rules using the source address and not the
interface???
> >
> > could it help???
>
> Could work, never tryed it, but how do i set it up to work on boot? i use
> RedHat 7.3 and have a /etc/sysconfig/network-scripts/ifcfg-eth0 file that
> has the next parameters:
> DEVICE="eth0"
> IPADDR="192.168.1.1"
> NETMASK="255.255.255.0"
> NETWORK=192.168.1.0
> ONBOOT="yes"
>
> Do i just simple add another IPADDR line?
>
> Thanks
>
> Rodrigo
>
> >
> >
> > ----- Original Message -----
> > From: "Rodrigo Haces" <rhaces_chistes@yahoo.com.mx>
> > To: <netfilter@lists.netfilter.org>
> > Sent: Monday, April 19, 2004 12:41 PM
> > Subject: IP Alias with iptables
> >
> >
> > > Hi:
> > >
> > > I have only one network adapter in my Server, but i need to have 2
> > different
> > > networks, 192.168.1.0 to the MAC addresses i know and 192.168.0.0 to
the
> > MAC
> > > addresses i dont't know, i have managed this by makin mi eth0 to
> > 192.168.1.1
> > > and an alias eth0:0 to 192.168.0.1, everythings ok, but i'm also
sharing
> > > internet, but when i start the rule to the eth0:0 it sends me
> > an error. Is
> > > there a way to use IP Aliasing with iptables? if not, is there a way
to
> > > create an eth0 and eth1 witn the same adapter?
> > >
> > > Thanks
> > >
> > > Rodrigo
> > >
> > >
> > >
>
>
>

IP Alias with iptables

[Rodrigo Haces]

Hi:

I have only one network adapter in my Server, but i need to have 2 different
networks, 192.168.1.0 to the MAC addresses i know and 192.168.0.0 to the MAC
addresses i dont't know, i have managed this by makin mi eth0 to 192.168.1.1
and an alias eth0:0 to 192.168.0.1, everythings ok, but i'm also sharing
internet, but when i start the rule to the eth0:0 it sends me an error. Is
there a way to use IP Aliasing with iptables? if not, is there a way to
create an eth0 and eth1 witn the same adapter?

Thanks

Rodrigo

RE: IP Alias with iptables

[Cedric Blancher]

Le lun 19/04/2004 à 18:07, Rodrigo Haces a écrit :
> Ok, this is what i want, i have a Restaurant, and have an administrative
> network (192.168.1.0) and i am giving wireless access to my clients, but i
> cant let them get into my administrative network, so i set them 192.168.0.0.

Then aliases are not secure enough to deal with your settings. I mean
any wireless client that would change its IP manually to 192.160.1.0
will get administrative network priviliedges. You have to separate
thoses two LANs physically using a second network adapter or use a VLAN
aware switch connected by a trunk to eth0, configured to support 802.1q
tagging.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

RE: IP Alias with iptables

[Rodrigo Haces]

> Enviado el: Lunes, 19 de Abril de 2004 08:54 a.m.
>
> On Monday 19 April 2004 4:41 pm, Rodrigo Haces wrote:
>
> > Hi:
> >
> > I have only one network adapter in my Server, but i need to have 2
> > different networks, 192.168.1.0 to the MAC addresses i know and
> 192.168.0.0
> > to the MAC addresses i don't know
>
> This sounds strange - what is your network layout, giving rise to
> machines
> with "MAC addresses you don't know", which need you to be on a different
> subnet?

Ok, this is what i want, i have a Restaurant, and have an administrative
network (192.168.1.0) and i am giving wireless access to my clients, but i
cant let them get into my administrative network, so i set them 192.168.0.0.

>
> > i have managed this by makin mi eth0 to
> > 192.168.1.1 and an alias eth0:0 to 192.168.0.1, everythings ok, but i'm
> > also sharing internet, but when i start the rule to the eth0:0
> it sends me
> > an error. Is there a way to use IP Aliasing with iptables?
>
> Yes - just remember that there's only one physical interface, and
> it's called
> eth0.   Don't try to use :0 or :1 in your netfilter rules.   You
> can always
> use -s or -d to specify source & destination IP addresses if you want the
> rule/s to apply only to certain packets.

ok, this are my rules, were and how do i use the -d and -s??

echo "   FWD: Allow all connections OUT and only existing and related ones
IN"
iptables -A FORWARD -i ppp0 -o eth0 -m state --state ESTABLISHED,RELATED -j
ACCEPT
iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
echo "   Enabling SNAT (MASQUERADE) functionality on ppp0"
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

>
> > if not, is there a way to create an eth0 and eth1 witn the same adapter?
>
> No.   It's a simple (and cheap) job to add another ethernet card, though.

No PCI slots available... :(

Thanks in advanced
Rodrigo

Re: IP Alias with iptables

[Alistair Tonner]

On April 19, 2004 03:25 pm, Antony Stone wrote:
> On Monday 19 April 2004 5:07 pm, Rodrigo Haces wrote:
> > > > I have only one network adapter in my Server, but i need to have 2
> > > > different networks, 192.168.1.0 to the MAC addresses i know and
> > > > 192.168.0.0 to the MAC addresses i don't know
> > >
< < Much snippage for brevity >>


> on which network range you want to do what.
>
> > > > if not, is there a way to create an eth0 and eth1 witn the same
> > > > adapter?
> > >
> > > No.   It's a simple (and cheap) job to add another ethernet card,
> > > though.
> >
> > No PCI slots available... :(
>
> I suggest another firewall then - trying to set up a firewall with only one
> ethernet interface is a poor enough solution (from a security point of
> view) in the first place, but if there is wireless access involved as well
> then I would not even consider it.
>
>
	Thanks Antony  -- again you have expressed precisely what I would have said 
-- succinctly and clearly.

	Aliased (stacked) interfaces ARE NOT SECURE.  Period.

	(And Hubs don't help)

	Alistair Tonner


 Regards,
>
> Antony.

RE: IP Alias with iptables

[Rodrigo Haces]

> Enviado el: Lunes, 19 de Abril de 2004 08:53 a.m.
>
> why not to use iproute2 adding a new ip address to the interface
> and filter
> with the source?
>
> like
>
> ip add add 192.168.0.1/24 dev eth0
> ip add add 192.168.1.1/24 dev eth0
>
> and then apply the rules using the source address and not the interface???
>
> could it help???

Could work, never tryed it, but how do i set it up to work on boot? i use
RedHat 7.3 and have a /etc/sysconfig/network-scripts/ifcfg-eth0 file that
has the next parameters:
DEVICE="eth0"
IPADDR="192.168.1.1"
NETMASK="255.255.255.0"
NETWORK=192.168.1.0
ONBOOT="yes"

Do i just simple add another IPADDR line?

Thanks

Rodrigo

>
>
> ----- Original Message -----
> From: "Rodrigo Haces" <rhaces_chistes@yahoo.com.mx>
> To: <netfilter@lists.netfilter.org>
> Sent: Monday, April 19, 2004 12:41 PM
> Subject: IP Alias with iptables
>
>
> > Hi:
> >
> > I have only one network adapter in my Server, but i need to have 2
> different
> > networks, 192.168.1.0 to the MAC addresses i know and 192.168.0.0 to the
> MAC
> > addresses i dont't know, i have managed this by makin mi eth0 to
> 192.168.1.1
> > and an alias eth0:0 to 192.168.0.1, everythings ok, but i'm also sharing
> > internet, but when i start the rule to the eth0:0 it sends me
> an error. Is
> > there a way to use IP Aliasing with iptables? if not, is there a way to
> > create an eth0 and eth1 witn the same adapter?
> >
> > Thanks
> >
> > Rodrigo
> >
> >
> >

RE: IP Alias with iptables

[Rodrigo Haces]

THANKS FOR ALL YOUR COMMENTS, i try all the answers you gave me and then see
which one is best for me and post again if anything comes up.

Thanks
Rodrigo

> -----Mensaje original-----
> De: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org]En nombre de Antony Stone
> Enviado el: Lunes, 19 de Abril de 2004 09:26 a.m.
> Para: netfilter@lists.netfilter.org
> Asunto: Re: IP Alias with iptables
>
>
> On Monday 19 April 2004 5:07 pm, Rodrigo Haces wrote:
>
> > > > I have only one network adapter in my Server, but i need to have 2
> > > > different networks, 192.168.1.0 to the MAC addresses i know and
> > > > 192.168.0.0 to the MAC addresses i don't know
> > >
> > > This sounds strange - what is your network layout, giving rise to
> > > machines with "MAC addresses you don't know", which need you
> to be on a
> > > different subnet?
> >
> > Ok, this is what i want, i have a Restaurant, and have an administrative
> > network (192.168.1.0) and i am giving wireless access to my
> clients, but i
> > cant let them get into my administrative network, so i set them
> > 192.168.0.0.
>
> I would *really* recommend that you have two physically separate
> subnets for
> this.   Otherwise there is nothing to stop someone using a
> wireless sniffer
> to see all the traffic on your administrative network.
>
> > > > i have managed this by makin mi eth0 to
> > > > 192.168.1.1 and an alias eth0:0 to 192.168.0.1, everythings
> ok, but i'm
> > > > also sharing internet, but when i start the rule to the
> eth0:0 it sends
> > > > me an error. Is there a way to use IP Aliasing with iptables?
> > >
> > > Yes - just remember that there's only one physical interface, and
> > > it's called eth0.   Don't try to use :0 or :1 in your netfilter rules.
> > > You can always use -s or -d to specify source & destination
> IP addresses
> > > if you want the rule/s to apply only to certain packets.
> >
> > ok, this are my rules, where and how do i use the -d and -s??
> >
> > echo "   FWD: Allow all connections OUT and only existing and
> related ones
> > IN"
> > iptables -A FORWARD -i ppp0 -o eth0 -m state --state
> ESTABLISHED,RELATED -j
> > ACCEPT
> > iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
> > echo "   Enabling SNAT (MASQUERADE) functionality on ppp0"
> > iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
>
> I can't answer your question properly because you haven't said
> what you want
> to allow and what you want to block (based on address, because
> you can't base
> it on interface name), however if for example you wanted to allow
> Internet
> access from network 192.168.0.0/24 and not allow it from
> 192.168.1.0/24, then
> you could use -s and -d like this:
>
> iptables -A POSTROUTING -o ppp0 -s 192.168.0.0/24 -j MASQUERADE
> iptables -A FORWARD -i eth0 -o ppp0 -s 192.168.0.0/24 -j ACCEPT
> iptables -A FORWARD -i ppp0 -o eth0 -d 192.168.0.0/24 -m state --state
> ESTABLISHED,RELATED -j ACCEPT
>
> I'm sure this gives you the idea of what I mean - simply adjust
> depending on
> which network range you want to do what.
>
> > > > if not, is there a way to create an eth0 and eth1 witn the same
> > > > adapter?
> > >
> > > No.   It's a simple (and cheap) job to add another ethernet
> card, though.
> >
> > No PCI slots available... :(
>
> I suggest another firewall then - trying to set up a firewall
> with only one
> ethernet interface is a poor enough solution (from a security
> point of view)
> in the first place, but if there is wireless access involved as
> well then I
> would not even consider it.
>
> Regards,
>
> Antony.
>
> --
> "There has always been an underlying argument that we should open up our
> source code more broadly. The fact is that we are learning from
> open source
> and we are opening our code more broadly through Shared Source.
>
> Is there value to providing source code? The answer is unequivocally yes."
>
>  - Jason Matusow, head of Microsoft's Shared Source Program, in
> response to
> recent leaks of Windows source code on the Internet.
>
>                                                      Please reply
> to the list;
>                                                            please
> don't CC me.
>

Re: IP Alias with iptables

[Antony Stone]

On Monday 19 April 2004 5:12 pm, Alistair Tonner wrote:

> On April 19, 2004 03:25 pm, Antony Stone wrote:
> >
> > I suggest another firewall then - trying to set up a firewall with only
> > one ethernet interface is a poor enough solution (from a security point
> > of view) in the first place, but if there is wireless access involved as
> > well then I would not even consider it.
>
> 	Thanks Antony  -- again you have expressed precisely what I would have
> said -- succinctly and clearly.
>
> 	Aliased (stacked) interfaces ARE NOT SECURE.  Period.

Indeed.   I would like to see this emphasised more in the netfilter howtos & 
tutorials.   Multiple addresses on one interface are all very well, so long 
as they exist within the same subnet; however anyone trying to use multiple 
*network* addresses on one physical interface is defeating their security by 
ignoring what the different OSI network layers mean.

Even someone who thinks "I have a switch; my packets cannot be sniffed" simply 
hasn't investigated Dug Song's (and similar) network tools sufficiently.

Regards,

Antony.

-- 
Having been asked for a reference for this man,
I can confirm that you will be very lucky indeed if you can get him to work 
for you.

                                                     Please reply to the list;
                                                           please don't CC me.

RE: IP Alias with iptables

[Rodrigo Haces]

New Situation:

I have managed to have another interface so this is my situation:

My Server:

eth0: 192.168.1.1 Connected to hub 1
eth1: 192.168.0.1 Connected to hub 2

hub 1 is for guests
hub 2 is for administrative porposes, and MUST be able to use network
192.168.0.x and 192.168.1.x

so this is something i thought.

eth0... 192.168.1.1 netmask 255.255.255.0
eth1... 192.168.0.1 netmask 255.255.0.0
eth1:1. 192.168.1.101 netmask 255.255.0.0

my laptop is part of the administrative sector, i have 192.168.0.10 ip, but
i need to be able to use also 192.168.1.10 so i can monitor guests, if i
switch to 192.168.1.10 i just simply cant see anything (nither the server at
192.168.1.101 nor 192.168.0.1 and 192.168.1.1).

Any ideas
Thanks

Rodrigo

> -----Mensaje original-----
> De: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org]En nombre de Antony Stone
> Enviado el: Lunes, 19 de Abril de 2004 03:32 p.m.
> Para: netfilter@lists.netfilter.org
> Asunto: Re: IP Alias with iptables
>
>
> On Monday 19 April 2004 5:12 pm, Alistair Tonner wrote:
>
> > On April 19, 2004 03:25 pm, Antony Stone wrote:
> > >
> > > I suggest another firewall then - trying to set up a firewall
> with only
> > > one ethernet interface is a poor enough solution (from a
> security point
> > > of view) in the first place, but if there is wireless access
> involved as
> > > well then I would not even consider it.
> >
> > 	Thanks Antony  -- again you have expressed precisely what I
> would have
> > said -- succinctly and clearly.
> >
> > 	Aliased (stacked) interfaces ARE NOT SECURE.  Period.
>
> Indeed.   I would like to see this emphasised more in the
> netfilter howtos &
> tutorials.   Multiple addresses on one interface are all very
> well, so long
> as they exist within the same subnet; however anyone trying to
> use multiple
> *network* addresses on one physical interface is defeating their
> security by
> ignoring what the different OSI network layers mean.
>
> Even someone who thinks "I have a switch; my packets cannot be
> sniffed" simply
> hasn't investigated Dug Song's (and similar) network tools sufficiently.
>
> Regards,
>
> Antony.
>
> --
> Having been asked for a reference for this man,
> I can confirm that you will be very lucky indeed if you can get
> him to work
> for you.
>
>                                                      Please reply
> to the list;
>                                                            please
> don't CC me.
>

Re: IP Alias with iptables

[Antony Stone]

On Tuesday 20 April 2004 4:08 am, Rodrigo Haces wrote:

> New Situation:
>
> eth0: 192.168.1.1 Connected to hub 1
> eth1: 192.168.0.1 Connected to hub 2
>
> hub 1 is for guests
> hub 2 is for administrative porposes, and MUST be able to use network
> 192.168.0.x and 192.168.1.x

So, the firewall needs to allow 192.168.1.0/24 addresses to connect to 
192.168.0.0/24 but not the other way round.

> so this is something i thought.
>
> eth0... 192.168.1.1 netmask 255.255.255.0
> eth1... 192.168.0.1 netmask 255.255.0.0

Doesn't look good.

> eth1:1. 192.168.1.101 netmask 255.255.0.0

Looks as bad as the first idea, with only one interface.

> my laptop is part of the administrative sector, i have 192.168.0.10 ip, but
> i need to be able to use also 192.168.1.10 so i can monitor guests,

What is wrong with yur laptop havign just one IP address (that *is* 
conventional, after all), and the firewall allowing it to "monitor" addresses 
in the other subnet?   Perhaps you should explain more about what you mean by 
"monitor"?

> Any ideas

Yes.   Have two subnets with separate address ranges, a firewall in between, 
and allow one subnet to connect to the other, but not the other way round.

eg:
eth0 192.168.1.1 netmask 255.255.255.0
eth1 192.168.0.1 netmask 255.255.255.0

iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

Regards,

Antony.

-- 
Success is a lousy teacher.  It seduces smart people into thinking they can't 
lose.

 - William H Gates III

                                                     Please reply to the list;
                                                           please don't CC me.

Re: IP Alias with iptables

[Dick St.Peters]

> > 	Aliased (stacked) interfaces ARE NOT SECURE.  Period.
> 
> Indeed.   I would like to see this emphasised more in the netfilter howtos & 
> tutorials.   Multiple addresses on one interface are all very well, so long 
> as they exist within the same subnet; however anyone trying to use multiple 
> *network* addresses on one physical interface is defeating their security by 
> ignoring what the different OSI network layers mean.

I want to add some qualification to these overstatements.  Aliased
interfaces do not inherently introduce any insecurity in cases where
you don't care about subnet separation.  For example, a hosting
service that receives and uses a new address allocation not contiguous
with its existing subnet is living with reality, not ignoring what the
network layers mean nor defeating its security.

(As an aside, the OSI model is really little more than a sometimes
useful abstraction anyway.  Twenty years ago it was already hard to
relate to a corporate network that used both IP-encapsulated DECnet
and DECnet-encapsulated IP.  Today's networks abound with VPNs that
muddle the OSI model.)

--
Dick St.Peters, stpeters@NetHeaven.com 

Re: IP Alias with iptables

[Antony Stone]

On Tuesday 20 April 2004 7:06 pm, Dick St.Peters wrote:

(Quoted from Alistair Tonner):

> > > 	Aliased (stacked) interfaces ARE NOT SECURE.  Period.

(Quoted from me):

> > Indeed.   I would like to see this emphasised more in the netfilter
> > howtos & tutorials.   Multiple addresses on one interface are all very
> > well, so long as they exist within the same subnet; however anyone trying
> > to use multiple *network* addresses on one physical interface is
> > defeating their security by ignoring what the different OSI network
> > layers mean.
>
> I want to add some qualification to these statements.  Aliased
> interfaces do not inherently introduce any insecurity in cases
> where you don't care about subnet separation.

I agree.   However, Alistair and I were not claiming that aliased interfaces 
introduce an insecurity where you don't require any security - we were simply 
saying that you cannot (should not) use them where you require to have secure 
separation of your subnets.

If you want to overlap two logical networks on one physical infrastructure, 
and you do not require any security between them, then aliased interfaces are 
ideal for the job.

However, if you are trying to keep two logical networks securely separate from 
each other (as the original poster wanted to do), then aliased interfaces 
will defeat your attempts at this.

Regards,

Antony.

-- 
There are two possible outcomes:

 If the result confirms the hypothesis, then you've made a measurement.
 If the result is contrary to the hypothesis, then you've made a discovery.

 - Enrico Fermi

                                                     Please reply to the list;
                                                           please don't CC me.

RE: IP Alias with iptables

[Rodrigo Haces]

Thanks for this, hope this is my last post:

assuming this will allow all 192.168.1.0/24 go to 192.168.0.0/24 how could i
do if i want not all the subnet, but only 192.168.1.10, i suppose is with
the -s option, but im not sure of how to use this.

Thanks
Rodrigo

> -----Mensaje original-----
> De: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org]En nombre de Antony Stone
> Enviado el: Martes, 20 de Abril de 2004 01:33 a.m.
> Para: Netfilter
> Asunto: Re: IP Alias with iptables
>
>
> On Tuesday 20 April 2004 4:08 am, Rodrigo Haces wrote:
>
> > New Situation:
> >
> > eth0: 192.168.1.1 Connected to hub 1
> > eth1: 192.168.0.1 Connected to hub 2
> >
> > hub 1 is for guests
> > hub 2 is for administrative porposes, and MUST be able to use network
> > 192.168.0.x and 192.168.1.x
>
> So, the firewall needs to allow 192.168.1.0/24 addresses to connect to
> 192.168.0.0/24 but not the other way round.
>
> > so this is something i thought.
> >
> > eth0... 192.168.1.1 netmask 255.255.255.0
> > eth1... 192.168.0.1 netmask 255.255.0.0
>
> Doesn't look good.
>
> > eth1:1. 192.168.1.101 netmask 255.255.0.0
>
> Looks as bad as the first idea, with only one interface.
>
> > my laptop is part of the administrative sector, i have
> 192.168.0.10 ip, but
> > i need to be able to use also 192.168.1.10 so i can monitor guests,
>
> What is wrong with yur laptop havign just one IP address (that *is*
> conventional, after all), and the firewall allowing it to
> "monitor" addresses
> in the other subnet?   Perhaps you should explain more about what
> you mean by
> "monitor"?
>
> > Any ideas
>
> Yes.   Have two subnets with separate address ranges, a firewall
> in between,
> and allow one subnet to connect to the other, but not the other way round.
>
> eg:
> eth0 192.168.1.1 netmask 255.255.255.0
> eth1 192.168.0.1 netmask 255.255.255.0
>
> iptables -P FORWARD DROP
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
>
> Regards,
>
> Antony.
>
> --
> Success is a lousy teacher.  It seduces smart people into
> thinking they can't
> lose.
>
>  - William H Gates III
>
>                                                      Please reply
> to the list;
>                                                            please
> don't CC me.
>

Re: IP Alias with iptables

[Antony Stone]

On Wednesday 21 April 2004 12:39 am, Rodrigo Haces wrote:

> Thanks for this, hope this is my last post:
>
> assuming this will allow all 192.168.1.0/24 go to 192.168.0.0/24 how could
> i do if i want not all the subnet, but only 192.168.1.10, i suppose is with
> the -s option, but im not sure of how to use this.

iptables -A FORWARD -i eth0 -o eth1 -s 192.168.1.10 -j ACCEPT

Regards,

Antony

> > -----Mensaje original-----
> > De: netfilter-admin@lists.netfilter.org
> > [mailto:netfilter-admin@lists.netfilter.org]En nombre de Antony Stone
> > Enviado el: Martes, 20 de Abril de 2004 01:33 a.m.
> > Para: Netfilter
> > Asunto: Re: IP Alias with iptables
> >
> > On Tuesday 20 April 2004 4:08 am, Rodrigo Haces wrote:
> > > New Situation:
> > >
> > > eth0: 192.168.1.1 Connected to hub 1
> > > eth1: 192.168.0.1 Connected to hub 2
> > >
> > > hub 1 is for guests
> > > hub 2 is for administrative porposes, and MUST be able to use network
> > > 192.168.0.x and 192.168.1.x
> >
> > So, the firewall needs to allow 192.168.1.0/24 addresses to connect to
> > 192.168.0.0/24 but not the other way round.
> >
> > > so this is something i thought.
> > >
> > > eth0... 192.168.1.1 netmask 255.255.255.0
> > > eth1... 192.168.0.1 netmask 255.255.0.0
> >
> > Doesn't look good.
> >
> > > eth1:1. 192.168.1.101 netmask 255.255.0.0
> >
> > Looks as bad as the first idea, with only one interface.
> >
> > > my laptop is part of the administrative sector, i have
> >
> > 192.168.0.10 ip, but
> >
> > > i need to be able to use also 192.168.1.10 so i can monitor guests,
> >
> > What is wrong with yur laptop havign just one IP address (that *is*
> > conventional, after all), and the firewall allowing it to
> > "monitor" addresses
> > in the other subnet?   Perhaps you should explain more about what
> > you mean by
> > "monitor"?
> >
> > > Any ideas
> >
> > Yes.   Have two subnets with separate address ranges, a firewall
> > in between,
> > and allow one subnet to connect to the other, but not the other way
> > round.
> >
> > eg:
> > eth0 192.168.1.1 netmask 255.255.255.0
> > eth1 192.168.0.1 netmask 255.255.255.0
> >
> > iptables -P FORWARD DROP
> > iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> > iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
> >
> > Regards,
> >
> > Antony.
> >
> > --
> > Success is a lousy teacher.  It seduces smart people into
> > thinking they can't
> > lose.
> >
> >  - William H Gates III
> >
> >                                                      Please reply
> > to the list;
> >                                                            please
> > don't CC me.

-- 
"It would appear we have reached the limits of what it is possible to achieve 
with computer technology, although one should be careful with such 
statements; they tend to sound pretty silly in five years."

 - John von Neumann (1949)

                                                     Please reply to the list;
                                                           please don't CC me.