RE: Change of ip addresses continues.... :(

RE: Change of ip addresses continues.... :(

[Jason Opperisano]

> I have been trying various set of rules in various table in order to have packets go over
> the right link. ie. packet's src add should match outgoing link's ip address.YET, there
> are some packets that always tend to go over the wrong link and thus causing ip address
> change. They mostly seem to be ICMP Destination Unreacheable messages or DNS queries.

please verify that the ICMP dest-unreach & DNS queries are not locally generated packets from the firewall machine itself.  everything you're doing thus far applies to packets being routed through the firewall; not from the firewall--that's a whole different story...

> I tried out the rules that Daniel Chemko so generously had provided me with...and they
> don't seem to work. I am probably not doing something right. I just tried thefollowing
> rules with no luck:
>
> iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
> iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
> iptables -t mangle -A PREROUTING -m mark ! --mark 0 -p icmp -j MARK --set-mark 1
> iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j MARK --set-mark 2
> iptables -t mangle -A PREROUTING -j CONNMARK --save-mark
> iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
> ptables -t nat -A POSTROUTING -o ppp1 -j MASQUERADE
>
> Are these rules supposed to create 2 routing tables???? If they do, I don't seem them?
> This is what I see:
>
> [ ]# ip rule list
> 0:      from all lookup local
> 32766:  from all lookup main
> 32767:  from all lookup 253

no--iptables commands do not create extra routing tables--you have to do this yourself.  hopefully, you've been studying up on http://lartc.org/howto/index.html (specifically http://lartc.org/howto/lartc.netfilter.html)

something like:

  echo 500 icmp >> /etc/iproute2/rt_tables
  ip rule add fwmark 1 table icmp
  ip route add default via $ICMP_LINK dev $ICMP_LINK_IF table icmp

will make the packets marked with "--set-mark 1" (icmp packets in your example), get their default gateway from the alternate routing table named "icmp"

again--this applies to packets being routed through the gateway, not to packets coming from the gateway.

-j

RE: Change of ip addresses continues.... :(

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 717 bytes --]

On Thu, 2004-08-26 at 23:26, Jason Opperisano wrote:
> > I have been trying various set of rules in various table in order to have packets go over
> > the right link. ie. packet's src add should match outgoing link's ip address.YET, there
> > iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
> > iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
> > iptables -t mangle -A PREROUTING -m mark ! --mark 0 -p icmp -j MARK --set-mark 1
> > iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j MARK --set-mark 2

There's something weird here : 
-m mark ! --mark 0 
at each line you should better do 
-m mark --mark 0
at the two last lines.

BR,
-- 
Eric Leblond <eric@inl.fr>
INL

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Odd question with source based blocking

[Michael Sconzo]

I have a brief (hopefully) question.

I currently have a box that sits inline with a firewall setup similiar
to the following

FORWARD - Policy - DROP
 * allow DNS
 * allow DHCP
 * all WEB
 * allow all from 192.168.1.0/24 -> BLOCKED
 * allow all to 192.168.1.0/24 -> BLOCKED

BLOCKED
 * Block this IP
 * Block this other IP
 * etc ...

I've tried setting the default policy of BLOCKED to accept, however it
doesn't seem to let traffic through that doesn't match any one of the
'block this IP rule'.

The only catch is, I remove the 'block this IP' rules from the BLOCKED
list, so it makes it hard to ensure an ALLOW rule remains at the
bottom.  Any ideas on how I can do this (default allow traffic not
hitting a rule on BLOCKED to be ALLOWED?

Thanks!
-=Mike

-- 
_
_ Michael J. Sconzo
_ Computing & Information Services, Texas A&M University

The New Testament offers the basis for modern computer coding theory,
in the form of an affirmation of the binary number system.
        But let your communication be Yea, yea; nay, nay: for
        whatsoever is more than these cometh of evil.
                -- Matthew 5:37

RE: Change of ip addresses continues.... :(

[Daniel Chemko]

Eric Leblond wrote:
> On Thu, 2004-08-26 at 23:26, Jason Opperisano wrote:
>>> I have been trying various set of rules in various table in order
>>> to have packets go over the right link. ie. packet's src add should
>>> match outgoing link's ip address.YET, there iptables -t mangle -A
>>> PREROUTING -j CONNMARK --restore-mark 
>>> iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
>>> iptables -t mangle -A PREROUTING -m mark ! --mark 0 -p icmp -j MARK
>>> --set-mark 1 iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j
>>> MARK --set-mark 2 
> 
> There's something weird here :
> -m mark ! --mark 0
> at each line you should better do
> -m mark --mark 0
> at the two last lines.
> 
> BR,

Just to confirm, Eric is correct, you should be using -m mark --mark 0
for the last two rules. In conclusion, for the most simple of setups for
this, we'd have the following:

	iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
# Skip through any pre-classifed traffic
	iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
# Define inbound policies
	iptables -t mangle -A PREROUTING -m mark --mark 0 -m state
--state NEW -i ppp0 -j MARK --set-mark 1
	iptables -t mangle -A PREROUTING -m mark --mark 0 -m state
--state NEW -i ppp1 -j MARK --set-mark 2
# Default policy route for any internal traffic
	iptables -t mangle -A PREROUTING -m mark --mark 0 -j MARK
--set-mark 2
	iptables -t mangle -A PREROUTING -j CONNMARK --save-mark

	iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
	iptables -t mangle -A OUTPUT -m mark ! --mark 0 -j ACCEPT
# Make sure any packets that have existing IP's before this networking
level to keep their existing IP's
	iptables -t mangle -A OUTPUT -m mark --mark 0 --source
${ppp0_ip} -j MARK --set-mark 1
	iptables -t mangle -A OUTPUT -m mark --mark 0 --source
${ppp1_ip} -j MARK --set-mark 2
# Default policy route for this firewall
	iptables -t mangle -A OUTPUT -m mark --mark 0 -j MARK --set-mark
2
	iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o ppp1 -j MASQUERADE

RE: Change of ip addresses continues.... :(

[Daniel Chemko]

First, you must understand that PREROUTING will only handle policy
routing FORWARDED traffic, and will not properly deal with traffic from
the firewall itself. Please make sure to duplicate the rules with:
"iptables -t mangle -A OUTPUT". That means, if the firewall gets an
invalid TCP connection attempt, it will send the ICMP reply out the
correct interface. 

Ok, to make your routes, here's a pre-canned function:

You'll have to fix up the following function to create the default route
the way that ppp assigns them. What I'd do is add this to ppp's ip-up
script so that as soon as you know your new ppp address, you change the
table to reflect the new value. 


Here 'might' be a way to do it. I don't have ppp lines so I couldn't say
if its right or not.

_mark="$((`echo "${1}" | sed s/ppp//`+1))"
_ext_gw="${5}";
_local_ip="${4}";

route_builder "${_mark}" "${_ext_gw}" "${_local_ip}"


The following IS what I use to build routes. I'm pretty sure it'll work
as advertised.
#
# Notes:
#    This function generates a new routing table based on the currect
main
#    routing table. The difference is that the default route is user
specified.
# 
# Arguments:
#    1 - Table ID to create
#    2 - IP Address, Gateway Address 
#    3 - IP Address, Local Source
#
IP=ip
function route_builder
{
   _table_id=${1}
   _table_gateway=${2}
   _table_source=${3}
   if [ "${1}" != "" -a "${2}" != "" ]; then
      ${IP} rule del fwmark ${_table_id} table ${_table_id}
      ${IP} rule add fwmark ${_table_id} table ${_table_id}
      ${IP} route flush table ${_table_id}
      ${IP} route show table main | grep -Ev ^default
\
      | while read ROUTE ; do   
         ${IP} route add table ${_table_id} $ROUTE
      done
      ${IP} route add table ${_table_id} default via ${_table_gateway}
\
         src ${_table_source}
   else
      echo "route_builder: Invalid arguments specified."
   fi
}

RE: Change of ip addresses continues.... :(

[Jason Opperisano]

>   echo 500 icmp >> /etc/iproute2/rt_tables
>   ip rule add fwmark 1 table icmp
>   ip route add default via $ICMP_LINK dev $ICMP_LINK_IF table icmp

crap...  that's not very clear--it should be:

  ip route add default via $ICMP_LINK_GW dev $ICMP_LINK_IF table icmp

for example:

  ip route add default via 1.2.3.4 dev ppp0 table icmp

sorry.

-j

Change of ip addresses continues.... :(

[dravya]

Hi people/Daniel,

I have been trying various set of rules in various table in order to have packets go over
the right link. ie. packet's src add should match outgoing link's ip address. YET, there
are some packets that always tend to go over the wrong link and thus causing ip address
change. They mostly seem to be ICMP Destination Unreacheable messages or DNS queries.

I tried out the rules that Daniel Chemko so generously had provided me with...and they
don't seem to work. I am probably not doing something right. I just tried the following
rules with no luck:

iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
iptables -t mangle -A PREROUTING -m mark ! --mark 0 -p icmp -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -j CONNMARK --save-mark
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
ptables -t nat -A POSTROUTING -o ppp1 -j MASQUERADE

Are these rules supposed to create 2 routing tables???? If they do, I don't seem them? 
This is what I see:

[ ]# ip rule list
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup 253

I even tried the ROUTE rule separately with no luck (still ip changes):

iptables -A POSTROUTING -t mangle -p icmp -j ROUTE --oif ppp0

Not to mention I initially tried MASQUERADING and that is when Daniel told me that there
were a few problems with Masquerading. 

I am to the point of pulling my hair.... thus... any help whatsoever would be appreciated.
Thanks guys,

Dravya