How to drop/reject packets amongst LAN clients?

How to drop/reject packets amongst LAN clients?

[michael]

Hi Group:

Setup:

Linux box acting as gateway/router/firewall for a LAN connected to the
internet by way of DSL connection.
eth0 - goes to the internet
eth1 - is gateway for the LAN
Linux box is using iptables version 1.2.9

Environment:

The LAN currently has 5 computers connected to it with static IP
addresses:

192.168.1.2
192.168.1.3
192.168.1.4
192.168.1.5
192.168.1.6

I will be adding 3 more machines with with static IP addresses:

192.168.1.7
192.168.1.8
192.168.1.9

Issue:

*.9 needs to remain accessible from *.7 and *.8; however, I need to
restrict any connection or accessibility to *.9 from *.2 - *.6.

I know how to restrict all access to *.9 by doing the following rule:

$IPTABLES -t filter -A FORWARD -p all --destination 192.168.1.9 -j DROP
or
$IPTABLES -t filter -A FORWARD -p all --destination 192.168.1.9 -j
REJECT

But I don't know how to craft a rule that allows only some machines to
send/receive data packets to/from *.9 while blocking other machines'
access to *.9 on the LAN.

I don't think prerouting or postrouting is the answer for this situation
but I could be wrong.  Thank you for your time and assistance.  All
guidance and responses are greatly appreciated.

Mike 

Re: How to drop/reject packets amongst LAN clients?

[Antony Stone]

On Monday 10 May 2004 5:23 pm, michael@floog.net wrote:

> The LAN currently has 5 computers connected to it with static IP
> addresses:
>
> 192.168.1.2
> 192.168.1.3
> 192.168.1.4
> 192.168.1.5
> 192.168.1.6
>
> I will be adding 3 more machines with with static IP addresses:
>
> 192.168.1.7
> 192.168.1.8
> 192.168.1.9
>
> Issue:
>
> *.9 needs to remain accessible from *.7 and *.8; however, I need to
> restrict any connection or accessibility to *.9 from *.2 - *.6.

Netfilter (on the gateway router) is no use to you here, because packets 
between machines on the same subnet do not go through the router - they just 
talk to each other directly across your hub / switch.

Install netfilter on 192.168.1.9 and put rules in the INPUT chain:

iptables -A INPUT -A INPUT -s 192.168.1.7 -j ACCEPT
iptables -A INPUT -A INPUT -s 192.168.1.0/29 -j DROP

Regards,

Antony.

-- 
The idea that Bill Gates appeared like a knight in shining armour to lead all 
customers out of a mire of technological chaos neatly ignores the fact that 
it was he who, by peddling second-rate technology, led them into it in the 
first place.

 - Douglas Adams in The Guardian, 25th August 1995

                                                     Please reply to the list;
                                                           please don't CC me.

Re: How to drop/reject packets amongst LAN clients?

[Cedric Blancher]

Le lun 10/05/2004 à 18:23, michael@floog.net a écrit :
> The LAN currently has 5 computers connected to it with static IP
> addresses:
> 192.168.1.2
[...]
> 192.168.1.6
> I will be adding 3 more machines with with static IP addresses:
> 192.168.1.7
> 192.168.1.8
> 192.168.1.9
> Issue:
> *.9 needs to remain accessible from *.7 and *.8; however, I need to
> restrict any connection or accessibility to *.9 from *.2 - *.6.

You can't restrict this kind of communication for it does not go through
your box. If you want to achieve this, then you have a Linux box a a
filtering bridge. Cheap quick recipe would be to add a third ethernet
interface to your box and configure it like this :

eth0 gos to the internet
eth1 goes to a switch where *.2 to *.6 are connected
eth2 goes to a switch where *.7 to *.9 are connected
create a bridge (br0) to which belong eth1 and eth2.
assign br0 former eth1 IP

Activate bridge filtering (available in stock 2.6 kernels) using
Netfilter and you're done. Just filter traffic in FORWARD chain, using
physdev match to specify eth1 and eth2 and incoming and/or outgoing
interface, and restrict traffic other than IP stuff using ebtables.

See http://ebtables.sourceforge.net/ documentation section.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: How to drop/reject packets amongst LAN clients?

[Aleksandar Milivojevic]

michael@floog.net wrote:
> Hi Group:
> But I don't know how to craft a rule that allows only some machines to
> send/receive data packets to/from *.9 while blocking other machines'
> access to *.9 on the LAN.

Machines on LAN talk directly to each other.  Those packets do not go 
through your firewall, so you can't block them there.

There are two solution to your problem:

If 192.168.1.9 is a Linux box, configure Netfilter on it so that 
anything not from 7 or 8 is dropped.

Second solution would be to put new server onto separate LAN. 
192.168.1.9 will become 192.168.2.9 (or whatever).  Than clients on your 
first LAN (192.168.1.0/24) will have to talk to your firewall/router to 
get to the server on your second LAN (192.168.2.0/24).

You will need one more ethernet card for second solution.  If additional 
server is going to be the only host in second LAN, you can connect it 
directly with cross over cable.  If you are going to add more servers to 
second LAN, you will also need additional hub or switch (do not connect 
two LANs into same hub).

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7

Re: How to drop/reject packets amongst LAN clients?

[michael]

Hi Antony,

Thanks for the rapid response to my post.  I see you what you are
saying.

Maybe I could add a 3rd NIC to the linux router/firewall box and call it
eth2 and give it a different subnet like 192.168.2.1 and then
192.168.1.9 will become 192.168.2.2 on the new subnet.

By doing so, will I then be able to route data from only the *.7 and
*.8
connections on subnet 192.168.1.1 to the box on 192.168.2.2? 

Thanks for the guidance.

Mike


Quoting Antony Stone <Antony@Soft-Solutions.co.uk>:

> Netfilter (on the gateway router) is no use to you here, because
> packets 
> between machines on the same subnet do not go through the router -
> they just 
> talk to each other directly across your hub / switch.
> 
> Install netfilter on 192.168.1.9 and put rules in the INPUT chain:
> 
> iptables -A INPUT -A INPUT -s 192.168.1.7 -j ACCEPT
> iptables -A INPUT -A INPUT -s 192.168.1.0/29 -j DROP
> 
> Regards,
> 
> Antony.

Re: How to drop/reject packets amongst LAN clients?

[Antony Stone]

On Monday 10 May 2004 6:14 pm, Cedric Blancher wrote:

> Le lun 10/05/2004 à 18:23, michael@floog.net a écrit :
> > The LAN currently has 5 computers connected to it with static IP
> > addresses:
> > 192.168.1.2
>
> [...]
>
> > 192.168.1.6
> > I will be adding 3 more machines with with static IP addresses:
> > 192.168.1.7
> > 192.168.1.8
> > 192.168.1.9
> > Issue:
> > *.9 needs to remain accessible from *.7 and *.8; however, I need to
> > restrict any connection or accessibility to *.9 from *.2 - *.6.
>
> You can't restrict this kind of communication for it does not go through
> your box. If you want to achieve this, then you have a Linux box a a
> filtering bridge.
>
> Activate bridge filtering (available in stock 2.6 kernels) using
> Netfilter and you're done.

Just an addendum to my previous response, which was a much simpler solution 
than this, but assumed (!) that the 192.168.1.9 machine was running Linux, 
and therefore could have netilter installed on it :)

Sorry for making that assumption - if it's not the case, then a bridging setup 
like Cedric has described is probably your best solution.

[ Note to self: I must remember that people use things other than Linux on 
their networks :)  ]

Regards,

Antony

-- 
It is also possible that putting the birds in a laboratory setting 
inadvertently renders them relatively incompetent.

 - Daniel C Dennet

                                                     Please reply to the list;
                                                           please don't CC me.

Re: How to drop/reject packets amongst LAN clients?

[Antony Stone]

On Monday 10 May 2004 6:31 pm, michael@floog.net wrote:

> Hi Antony,
>
> Thanks for the rapid response to my post.  I see you what you are
> saying.
>
> Maybe I could add a 3rd NIC to the linux router/firewall box and call it
> eth2 and give it a different subnet like 192.168.2.1 and then
> 192.168.1.9 will become 192.168.2.2 on the new subnet.

That would be an excellent solution - using NAT if you need the other machines 
to think it's 192.168.1.9 instead of 192.168.2.9 (however, they may be happy 
with the real address - it depends what you're using it for).

Regards,

Antony.

-- 
Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: How to drop/reject packets amongst LAN clients?

[Cedric Blancher]

Le lun 10/05/2004 à 19:34, Antony Stone a écrit :
> [ Note to self: I must remember that people use things other than Linux on 
> their networks :)  ]

True.
But, if they don't, they still can use pf ;)))

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: How to drop/reject packets amongst LAN clients?

[michael]

Aleksandar,

Thanks for your guidance.
It looks like I've got a fair amount of new reading to do after
receiving Antony, Cedric, and your suggestion.  I think I'll want to
install the 3rd NIC, and do some more NAT'ing and/or Bridge'ing.

First stop, www.tldp.org for review of documentation there.
Second stop, man route and/or routed.

I appreciate your help.

Mike



Quoting Aleksandar Milivojevic <amilivojevic@pbl.ca>:

> Second solution would be to put new server onto separate LAN. 
> 192.168.1.9 will become 192.168.2.9 (or whatever).  Than clients on
> your 
> first LAN (192.168.1.0/24) will have to talk to your firewall/router
> to 
> get to the server on your second LAN (192.168.2.0/24).
> 
> You will need one more ethernet card for second solution.  If
> additional 
> server is going to be the only host in second LAN, you can connect it
> 
> directly with cross over cable.  If you are going to add more servers
> to 
> second LAN, you will also need additional hub or switch (do not
> connect 
> two LANs into same hub).
> 
> -- 
> Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote