quick questions ---

quick questions ---

[Knight, Steve]

Hi chaps

Had a bit of a google, and of course consulted Ziegler, but I'm still not
100% on either of these, so ---

1) can iptables use eth0:0 as a valid interface distinct from eth0 ?  So I
can use eth0 as LAN internal i/f and eth0:0 as DMZ internal i/f.

and ...

2) Back when I did my checkpoint certs we covered "static NAT" - simple
one-to-one address translation, rather than "hide NAT" - aka iptables SNAT /
MASQUERADE....

...the question I have is - 

is the example given in Ziegler starting on p280 and table 7.1 "Host
Forwarding to Servers in a Privately Addressed DMZ" an example of "static
NAT"?

Thanks for any pointers

Steve



-----------------------------------------------------------------------
Information in this email may be privileged, confidential and is 
intended exclusively for the addressee.  The views expressed may
not be official policy, but the personal views of the originator.
If you have received it in error, please notify the sender by return
e-mail and delete it from your system.  You should not reproduce, 
distribute, store, retransmit, use or disclose its contents to anyone.
 
Please note we reserve the right to monitor all e-mail
communication through our internal and external networks.
-----------------------------------------------------------------------

Re: quick questions ---

[Antony Stone]

On Thursday 27 November 2003 1:02 pm, Knight, Steve wrote:

> Hi chaps
>
> Had a bit of a google, and of course consulted Ziegler, but I'm still not
> 100% on either of these, so ---
>
> 1) can iptables use eth0:0 as a valid interface distinct from eth0 ?

No.   They're both the same physical device, and netfilter only knows it as 
eth0.

> So I can use eth0 as LAN internal i/f and eth0:0 as DMZ internal i/f.

You can if you really want to but nobody here will respect you for it :)

I almost completely blows away the concept of a DMZ - because somebody on your 
internal LAN can get unrestricted access to the DMZ machines simply by 
changing their IP address.

> and ...
>
> 2) Back when I did my checkpoint certs we covered "static NAT" - simple
> one-to-one address translation, rather than "hide NAT" - aka iptables SNAT
> / MASQUERADE....
>
> ...the question I have is -
>
> is the example given in Ziegler starting on p280 and table 7.1 "Host
> Forwarding to Servers in a Privately Addressed DMZ" an example of "static
> NAT"?

Please can you rephrase the question so that we can answer it without needing 
a copy of the book?

Antony.

-- 
All matter in the Universe can be placed into one of two categories:

1. Things which need to be fixed.
2. Things which need to be fixed once you've had a few minutes to play with 
them.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: quick questions ---

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 1900 bytes --]

On Thu, 2003-11-27 at 15:02, Knight, Steve wrote:
> Hi chaps
> 
> Had a bit of a google, and of course consulted Ziegler, but I'm still not
> 100% on either of these, so ---
> 
> 1) can iptables use eth0:0 as a valid interface distinct from eth0 ?  So I
> can use eth0 as LAN internal i/f and eth0:0 as DMZ internal i/f.
> 
No, not directly, but can be referenced by the virtual ip.

> and ...
> 
> 2) Back when I did my checkpoint certs we covered "static NAT" - simple
> one-to-one address translation, rather than "hide NAT" - aka iptables SNAT /
> MASQUERADE....
> 
> ...the question I have is - 
> 
> is the example given in Ziegler starting on p280 and table 7.1 "Host
> Forwarding to Servers in a Privately Addressed DMZ" an example of "static
> NAT"?
> 
That would be DNAT, not SNAT. and then it could be either 1:1 or N:1,
depending on the iptables rule.

> Thanks for any pointers
> 
> Steve
> 
> 
> 
> -----------------------------------------------------------------------
> Information in this email may be privileged, confidential and is 
> intended exclusively for the addressee.  The views expressed may
> not be official policy, but the personal views of the originator.
> If you have received it in error, please notify the sender by return
> e-mail and delete it from your system.  You should not reproduce, 
> distribute, store, retransmit, use or disclose its contents to anyone.
>  
> Please note we reserve the right to monitor all e-mail
> communication through our internal and external networks.
> -----------------------------------------------------------------------
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: quick questions ---

[Cedric Blancher]

Le jeu 27/11/2003 à 14:02, Knight, Steve a écrit :
> 1) can iptables use eth0:0 as a valid interface distinct from eth0 ?

No, because eth0:0 is _not_ an interface, it is an alias (afaik, usage
of eth0:0 aliases are deprecated for this very reason). It's just
another IP to which your interface (eth0) answers.

>  So I can use eth0 as LAN internal i/f and eth0:0 as DMZ internal i/f.

This is to me a _very_ bad idea.

The point of creating a DMZ is having public services hosted on a
different ethernet segment than the one used for LAN. As hosts with
public services are the most likely to get compromised, DMZ creates a
compartiment so a cracker who would root one of them won't get full
access to LAN stations. If your public services are on the same ethernet
segment than LAN is, the intruder will have full access to its
ressources... Setting up a different IP addressing scheme on the same
ethernet segment is no security at all.

If you want more info on what one can do once root on an ethernet
segment :

	http://www.arp-sk.org/

> 2) Back when I did my checkpoint certs we covered "static NAT" - simple
> one-to-one address translation, rather than "hide NAT" - aka iptables SNAT /
> MASQUERADE....
> ...the question I have is - 
> is the example given in Ziegler starting on p280 and table 7.1 "Host
> Forwarding to Servers in a Privately Addressed DMZ" an example of "static
> NAT"?

If my Ziegler remembers are OK, yes.

To map an IP, it should be something like 

	iptables -t nat -A PREROUTING -d $PubIP -j DNAT --to $PrivIP

If your want to map one service only (aka port forwarding) :

	iptables -t nat -A PREROUTING -d $PubIP --dport 80 \
		-DNAT --to $PrivIP:80

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread! 

RE: quick questions ---

[Knight, Steve]

Many many thanks to Ray, Anthony and Cedric - that's answered them
absolutely.

I'll shut up now and get back to lurking on the list learning from you
clever sorts...

Steve




-----Original Message-----
From: Cedric Blancher [mailto:blancher@cartel-securite.fr] 
Sent: 27 November 2003 13.27
To: Knight, Steve
Cc: netfilter@lists.netfilter.org
Subject: Re: quick questions ---


Le jeu 27/11/2003 à 14:02, Knight, Steve a écrit :
> 1) can iptables use eth0:0 as a valid interface distinct from eth0 ?

No, because eth0:0 is _not_ an interface, it is an alias (afaik, usage
of eth0:0 aliases are deprecated for this very reason). It's just
another IP to which your interface (eth0) answers.

>  So I can use eth0 as LAN internal i/f and eth0:0 as DMZ internal i/f.

This is to me a _very_ bad idea.

The point of creating a DMZ is having public services hosted on a
different ethernet segment than the one used for LAN. As hosts with
public services are the most likely to get compromised, DMZ creates a
compartiment so a cracker who would root one of them won't get full
access to LAN stations. If your public services are on the same ethernet
segment than LAN is, the intruder will have full access to its
ressources... Setting up a different IP addressing scheme on the same
ethernet segment is no security at all.

If you want more info on what one can do once root on an ethernet
segment :

	http://www.arp-sk.org/

> 2) Back when I did my checkpoint certs we covered "static NAT" - simple
> one-to-one address translation, rather than "hide NAT" - aka iptables SNAT
/
> MASQUERADE....
> ...the question I have is - 
> is the example given in Ziegler starting on p280 and table 7.1 "Host
> Forwarding to Servers in a Privately Addressed DMZ" an example of "static
> NAT"?

If my Ziegler remembers are OK, yes.

To map an IP, it should be something like 

	iptables -t nat -A PREROUTING -d $PubIP -j DNAT --to $PrivIP

If your want to map one service only (aka port forwarding) :

	iptables -t nat -A PREROUTING -d $PubIP --dport 80 \
		-DNAT --to $PrivIP:80

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread! 




-----------------------------------------------------------------------
Information in this email may be privileged, confidential and is 
intended exclusively for the addressee.  The views expressed may
not be official policy, but the personal views of the originator.
If you have received it in error, please notify the sender by return
e-mail and delete it from your system.  You should not reproduce, 
distribute, store, retransmit, use or disclose its contents to anyone.
 
Please note we reserve the right to monitor all e-mail
communication through our internal and external networks.
-----------------------------------------------------------------------