How filter IP address if it *changes* often?? (think dhcp)

How filter IP address if it *changes* often?? (think dhcp)

[seberino]

My iptables script filters incoming packets.

One filter is whether the destination address is
MY machine.

How do this if IP address changes uncontrollably
like with DHCP??

Thanks,

Chris

-- 
_______________________________________

Dr. Christian Seberino
SPAWAR Systems Center San Diego
Code 2872
49258 Mills Street, Room 158
San Diego, CA 92152-5385
U.S.A.

Phone: (619) 553-9973
Fax:   (619) 553-6521
Email: seberino@spawar.navy.mil
_______________________________________

RE: How filter IP address if it *changes* often?? (think dhcp)

[Rowan Reid]

> How do this if IP address changes uncontrollably
> like with DHCP??


The following sh script will extract the ip address of the external
interface. If the address changes forcable ie not just when you renew
your lease volentarily then run the script on cron

$IFCONFIG = /path/ifconfig
$EXTIF = ppp0 or whatever
$AWK=/patch/awk

EXTIP="`$IFCONFIG $EXTIF | $AWK \
 /$EXTIF/'{next}//{split($0,a,":");split(a[2],a," ");print a[1];exit}'`"

Re: How filter IP address if it *changes* often?? (think dhcp)

[Steve Mickeler]

Thats what the INPUT and OUTPUT chains are for.

They are for packets destined to and orignated from the local box running
iptables.




On Thu, 27 Mar 2003 seberino@spawar.navy.mil wrote:

> My iptables script filters incoming packets.
>
> One filter is whether the destination address is
> MY machine.
>
> How do this if IP address changes uncontrollably
> like with DHCP??
>
> Thanks,
>
> Chris
>
> --
> _______________________________________
>
> Dr. Christian Seberino
> SPAWAR Systems Center San Diego
> Code 2872
> 49258 Mills Street, Room 158
> San Diego, CA 92152-5385
> U.S.A.
>
> Phone: (619) 553-9973
> Fax:   (619) 553-6521
> Email: seberino@spawar.navy.mil
> _______________________________________
>

Re: How filter IP address if it *changes* often?? (think dhcp)

[seberino]

Steve

Thanks for the email.  Let me rerephrase my question.
Perhaps I wasn't clear....

How can you have a rule on your INPUT chain that
only allows your local box's IP address if "local box IP address" can
change without notice due to your DSL ISP's decision?

Chris


On Thu, Mar 27, 2003 at 11:16:55PM -0500, Steve Mickeler wrote:
> 
> Thats what the INPUT and OUTPUT chains are for.
> 
> They are for packets destined to and orignated from the local box running
> iptables.
> 
> 
> 
> 
> On Thu, 27 Mar 2003 seberino@spawar.navy.mil wrote:
> 
> > My iptables script filters incoming packets.
> >
> > One filter is whether the destination address is
> > MY machine.
> >
> > How do this if IP address changes uncontrollably
> > like with DHCP??
> >
> > Thanks,
> >
> > Chris
> >
> > --
> > _______________________________________
> >
> > Dr. Christian Seberino
> > SPAWAR Systems Center San Diego
> > Code 2872
> > 49258 Mills Street, Room 158
> > San Diego, CA 92152-5385
> > U.S.A.
> >
> > Phone: (619) 553-9973
> > Fax:   (619) 553-6521
> > Email: seberino@spawar.navy.mil
> > _______________________________________
> >

-- 
_______________________________________

Dr. Christian Seberino
SPAWAR Systems Center San Diego
Code 2872
49258 Mills Street, Room 158
San Diego, CA 92152-5385
U.S.A.

Phone: (619) 553-9973
Fax:   (619) 553-6521
Email: seberino@spawar.navy.mil
_______________________________________

RE: How filter IP address if it *changes* often?? (think dhcp)

[Michael K]

I'm using this in my script. The script runs _after_ the network script

EXTERNAL_IP=`ifconfig $EXTERNAL_INTERFACE | awk '/inet/ { print $2 }' |
awk -F "
But if your ip changes even when your computer is up, then this wont
work. Perhaps you could use the MAC-address match instead.

Here is the full config.

INTERNAL_INTERFACE='eth0'
EXTERNAL_INTERFACE='eth1'

INTERNAL_IP=`ifconfig $INTERNAL_INTERFACE | awk '/inet/ { print $2 }' |
awk -F "
INTERNAL_BROADCAST=`ifconfig $INTERNAL_INTERFACE | awk '/inet/ { print
$3 }' | a
INTERNAL_MASK=`ifconfig $INTERNAL_INTERFACE | awk '/inet/ { print $4 }'
| awk -F
INTERNAL_NETWORKID=`ipcalc -n $INTERNAL_IP $INTERNAL_MASK|awk -F "="
'{print $2}
INTERNAL_PREFIX=`ipcalc -p $INTERNAL_IP $INTERNAL_MASK |awk -F "="
'{print $2}'`
INTERNAL_NETWORK=$INTERNAL_IP/$INTERNAL_PREFIX

EXTERNAL_IP=`ifconfig $EXTERNAL_INTERFACE | awk '/inet/ { print $2 }' |
awk -F "
EXTERNAL_BROADCAST=`ifconfig $EXTERNAL_INTERFACE | awk '/inet/ { print
$3 }' | a
EXTERNAL_MASK=`ifconfig $EXTERNAL_INTERFACE | awk '/inet/ { print $4 }'
| awk -F
EXTERNAL_NETWORKID=`ipcalc -n $EXTERNAL_IP $EXTERNAL_MASK|awk -F "="
'{print $2}
EXTERNAL_PREFIX=`ipcalc -p $EXTERNAL_IP $EXTERNAL_MASK |awk -F "="
'{print $2}'`
EXTERNAL_NETWORK=$EXTERNAL_IP/$EXTERNAL_PREFIX
EXTERNAL_DNS=`grep nameserver /etc/resolv.conf|tail -n1|awk '{print
$2}'`

echo "    I N T E R N A L  C O N F I G"
echo "Internal Interface:   $INTERNAL_INTERFACE"
echo "Internal IP-address:  $INTERNAL_IP"
echo "Internal Networkmask: $INTERNAL_MASK"
echo "Internal Broadcast:   $INTERNAL_BROADCAST"
echo "Internal NetworkID:   $INTERNAL_NETWORKID"
echo "Internal Network:     $INTERNAL_NETWORK"

echo -e "\n"
echo "    E X T E R N A L  C O N F I G"
echo "External Interface:   $EXTERNAL_INTERFACE"
echo "External IP-address:  $EXTERNAL_IP"
echo "External Networkmask: $EXTERNAL_MASK"
echo "External Broadcast:   $EXTERNAL_BROADCAST"
echo "External NetworkID:   $EXTERNAL_NETWORKID"
echo "External Network:     $EXTERNAL_NETWORK"
echo "External NameServer:  $EXTERNAL_DNS"

/Klintan


> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org 
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of 
> seberino@spawar.navy.mil
> Sent: Friday, March 28, 2003 7:26 AM
> To: Steve Mickeler
> Cc: netfilter@lists.netfilter.org
> Subject: Re: How filter IP address if it *changes* often?? 
> (think dhcp)
> 
> 
> Steve
> 
> Thanks for the email.  Let me rerephrase my question.
> Perhaps I wasn't clear....
> 
> How can you have a rule on your INPUT chain that
> only allows your local box's IP address if "local box IP 
> address" can change without notice due to your DSL ISP's decision?
> 
> Chris
> 
> 
> On Thu, Mar 27, 2003 at 11:16:55PM -0500, Steve Mickeler wrote:
> > 
> > Thats what the INPUT and OUTPUT chains are for.
> > 
> > They are for packets destined to and orignated from the local box 
> > running iptables.
> > 
> > 
> > 
> > 
> > On Thu, 27 Mar 2003 seberino@spawar.navy.mil wrote:
> > 
> > > My iptables script filters incoming packets.
> > >
> > > One filter is whether the destination address is
> > > MY machine.
> > >
> > > How do this if IP address changes uncontrollably
> > > like with DHCP??
> > >
> > > Thanks,
> > >
> > > Chris
> > >
> > > --
> > > _______________________________________
> > >
> > > Dr. Christian Seberino
> > > SPAWAR Systems Center San Diego
> > > Code 2872
> > > 49258 Mills Street, Room 158
> > > San Diego, CA 92152-5385
> > > U.S.A.
> > >
> > > Phone: (619) 553-9973
> > > Fax:   (619) 553-6521
> > > Email: seberino@spawar.navy.mil 
> > > _______________________________________
> > >
> 
> -- 
> _______________________________________
> 
> Dr. Christian Seberino
> SPAWAR Systems Center San Diego
> Code 2872
> 49258 Mills Street, Room 158
> San Diego, CA 92152-5385
> U.S.A.
> 
> Phone: (619) 553-9973
> Fax:   (619) 553-6521
> Email: seberino@spawar.navy.mil 
> _______________________________________
> 
> 

Re: How filter IP address if it *changes* often?? (think dhcp)

[Kim Jensen]

On Friday 28 March 2003 07:26, seberino@spawar.navy.mil wrote:
> Steve
>
> Thanks for the email.  Let me rerephrase my question.
> Perhaps I wasn't clear....
>
> How can you have a rule on your INPUT chain that
> only allows your local box's IP address if "local box IP address" can
> change without notice due to your DSL ISP's decision?
>
> Chris
>
Hi Chris,

If you are having one interface for all incoming traffic and one for outgoing 
traffic, then you can simply filter it by looking at the interface like:

iptables -A INPUT -i LOCAL_IF -j ACCEPT

You can also set up your rule so it allows traffic from the IP range you have 
internally:

iptables -A INPUT -s LOCAL_NET -j ACCEPT

The rules are a little primitive, but I hope you get the idea.

/Kim

Re: How filter IP address if it *changes* often?? (think dhcp)

[Joel Newkirk]

On Friday 28 March 2003 01:26 am, seberino@spawar.navy.mil wrote:
> Steve
>
> Thanks for the email.  Let me rerephrase my question.
> Perhaps I wasn't clear....
>
> How can you have a rule on your INPUT chain that
> only allows your local box's IP address if "local box IP address" can
> change without notice due to your DSL ISP's decision?

Have a cron job that compares the output from ifconfig for the given 
interface with the output from "iptables -n -L INPUT".  If they differ, 
then the job can delete the current rule and insert a new one.

I wrote something similar for my system to adapt to a slow-changing IP on 
my DSL and update my SNAT rule and a text file with the new IP.

It's unusual, however, to actually need to use your own IP in the INPUT 
chain, as the only destination IP's that should appear there are those 
of the box itself, either public (internet) private (lan) or localhost 
(127.0.0.1 typically) and those three situations can usually be 
determined by matching interface instead of IP.  Normally the only time 
you'd need to match the IP in INPUT from the internet is when you have 
multiple public IP's, and usually in such cases they are static.  (but 
not always, granted)

j

Re: How filter IP address if it *changes* often?? (think dhcp)

[Tomasz Korycki]

At 01:26 2003-03-28, you wrote:
>Steve
>
>Thanks for the email.  Let me rerephrase my question.
>Perhaps I wasn't clear....
>
>How can you have a rule on your INPUT chain that
>only allows your local box's IP address if "local box IP address" can
>change without notice due to your DSL ISP's decision?

1. install and configure dhcpcd
2. it will install /etc/dhcpc/dhcpcd.exe, which is a script
3. open dhcpcd.exe. Read it.
4. At the end, there is a switch case, where You can take different actions if:
   4.1. the if has been brought up with the same IP
   4.2. the if has been brought up with new IP
   4.3. the if has been brought down
5. Obviously, You're interested in 4.2. I just call another script there, 
called restart-fw
6. In restart-fw I:
   6.1. shut down routing
   6.2. get the if's new IP
   6.3. start firewall with that new IP
   6.4. enable routing
7. salt and pepper to taste...