Re: bug? blocked packets get shadowed to internal network

Re: bug? blocked packets get shadowed to internal network

[Juergen Stohr]

Hi Chris,
> > I've noticed some problems with TCP resets not being generated properly in
> > recent kernels (since 2.4.19 I think). Could you try REJECT without
> > tcp-reset, and see if the ICMP error is sent out of the correct interface?
> 
> It's the same issue. We don't see the TCP resets because they are being
> sent out of the wrong interface. I'm investigating. In the mean time you 
> can try REJECT without tcp-reset, that works for us.
> 

Yes, REJECT without tcp-reset works as expected.

thanks,
	juergen

Re: bug? blocked packets get shadowed to internal network

[Juergen Stohr]

Hi Chris,
>
> > we are using a firewall with RedHat kernel 2.4.20-19.7. The firewall is
> > configured to block every packet with DPT 199 into our network.
>
> You haven't given us your ruleset. Are you using a REJECT rule, especially
> with TCP reset?

Yes, we are using REJECT with TCP reset
iptables -A DRP_PCKT -p tcp -j REJECT --reject-with tcp-reset

>
> > IN= OUT=eth0 SRC=xxx.xxx.151.184 DST=xxx.xxx.11.231 LEN=40 TOS=0x00 PREC=0x0
0 TT
> > L=255 ID=0 DF PROTO=TCP SPT=199 DPT=34869 WINDOW=0 RES=0x00 ACK RST URGP=0
>
> This looks like a completely standard TCP reset. I can't tell for sure
> without seeing your ruleset, but I suspect that either you are blocking
> the incoming packet with -j REJECT --reject-with tcp-reset, or else it's
> not being blocked at all, and what you see is the kernel resetting the
> connection in the normal way (since it's not listening on that port).

I will attach the complete ruleset to this mail. The problem is, that
the packet resetting the connection appears on the "wrong" interface. So if
eth1 is our external interface, the kernel should sent a RST ACK also to
eth1 (and not to eth0 which is the internal interface). As mentioned, the
2.4.18 didn't show that behaviour.

cheers,
        juergen

bug? blocked packets get shadowed to internal network

[Juergen Stohr]

Hi to all,

we are using a firewall with RedHat kernel 2.4.20-19.7. The firewall is
configured to block every packet with DPT 199 into our network. When doing
a "telnet server.in.our.network 199" from outside, the firewall correctly
drops that packet, logging

IN=eth1 OUT=eth0 SRC=xxx.xxx.11.231 DST=xxx.xxx.151.184 LEN=44 TOS=0x00 PREC=0x0
0 TTL=252 ID=12615 DF PROTO=TCP SPT=34869 DPT=199 WINDOW=8760 RES=0x00 SYN URGP=
0

to syslog. The external interface is eth1, internal is eth0.
However, at the same time, the firewall generates a packet which is droped
by the output chain of the firewall. It fakes the SRC and DST and wants to send
that packet to the internal server:

IN= OUT=eth0 SRC=xxx.xxx.151.184 DST=xxx.xxx.11.231 LEN=40 TOS=0x00 PREC=0x00 TT
L=255 ID=0 DF PROTO=TCP SPT=199 DPT=34869 WINDOW=0 RES=0x00 ACK RST URGP=0

When setting the output chain to accept policy, the above packet is delivered
to xxx.xxx.151.184!

How can we prohibit those packets to be generated? Kernel RH 2.4.18-x didn't
show that behaviour.

regards,
        juergen

Re: bug? blocked packets get shadowed to internal network

[Chris Wilson]

Hi Juergen,

> we are using a firewall with RedHat kernel 2.4.20-19.7. The firewall is
> configured to block every packet with DPT 199 into our network.

You haven't given us your ruleset. Are you using a REJECT rule, especially 
with TCP reset?

> IN= OUT=eth0 SRC=xxx.xxx.151.184 DST=xxx.xxx.11.231 LEN=40 TOS=0x00 PREC=0x00 TT
> L=255 ID=0 DF PROTO=TCP SPT=199 DPT=34869 WINDOW=0 RES=0x00 ACK RST URGP=0

This looks like a completely standard TCP reset. I can't tell for sure 
without seeing your ruleset, but I suspect that either you are blocking 
the incoming packet with -j REJECT --reject-with tcp-reset, or else it's 
not being blocked at all, and what you see is the kernel resetting the 
connection in the normal way (since it's not listening on that port).

Cheers, Chris.
-- 
   ___ __     _
 / __// / ,__(_)_  | Chris Wilson -- UNIX Firewall Lead Developer |
/ (_ / ,\/ _/ /_ \ | NetServers.co.uk http://www.netservers.co.uk |
\ _//_/_/_//_/___/ | 21 Signet Court, Cambridge, UK. 01223 576516 |

bug? blocked packets get shadowed to internal network

[Juergen Stohr]

Hi to all,

we are using a firewall with RedHat kernel 2.4.20-19.7. The firewall is
configured to block every packet with DPT 199 into our network. When doing
a "telnet server.in.our.network 199" from outside, the firewall correctly
drops that packet, logging

IN=eth1 OUT=eth0 SRC=xxx.xxx.11.231 DST=xxx.xxx.151.184 LEN=44 TOS=0x00 PREC=0x0
0 TTL=252 ID=12615 DF PROTO=TCP SPT=34869 DPT=199 WINDOW=8760 RES=0x00 SYN URGP=
0

to syslog. The external interface is eth1, internal is eth0.
However, at the same time, the firewall generates a packet which is droped
by the output chain of the firewall. It fakes the SRC and DST and wants to send
that packet to the internal server:

IN= OUT=eth0 SRC=xxx.xxx.151.184 DST=xxx.xxx.11.231 LEN=40 TOS=0x00 PREC=0x00 TT
L=255 ID=0 DF PROTO=TCP SPT=199 DPT=34869 WINDOW=0 RES=0x00 ACK RST URGP=0

When setting the output chain to accept policy, the above packet is delivered
to xxx.xxx.151.184!

How can we prohibit those packets to be generated? Kernel RH 2.4.18-x didn't
show that behaviour.

regards,
        juergen

bug? blocked packets get shadowed to internal network

[Juergen Stohr]

Hi to all,

we are using a firewall with RedHat kernel 2.4.20-19.7. The firewall is 
configured to block every packet with DPT 199 into our network. When doing
a "telnet server.in.our.network 199" from outside, the firewall correctly 
drops that packet, logging

IN=eth1 OUT=eth0 SRC=xxx.xxx.11.231 DST=xxx.xxx.151.184 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=12615 DF PROTO=TCP SPT=34869 DPT=199 WINDOW=8760 RES=0x00 SYN URGP=0

to syslog. The external interface is eth1, internal is eth0.
However, at the same time, the firewall generates a packet, which is droped
by the output chain of the firewall. It fakes the SRC and DST and wants to send
that packet to the internal server:

IN= OUT=eth0 SRC=xxx.xxx.151.184 DST=xxx.xxx.11.231 LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=TCP SPT=199 DPT=34869 WINDOW=0 RES=0x00 ACK RST URGP=0

When setting the output chain to accept policy, the above packet is delivered
xxx.xxx.151.184!

How can we prohibit those packets to be generated? Kernel RH 2.4.18-x didn't
show that behaviour.

Please CC me as I'm not subscribed.

regards,
	juergen

Re: bug? blocked packets get shadowed to internal network

[Arnt Karlsen]

On Thu, 14 Aug 2003 11:34:48 +0200, 
Juergen Stohr <stohr@lpr.e-technik.tu-muenchen.de> wrote in message 
<20030814113448.A21598@rcs.ei.tum.de>:

> Hi to all,
> 
> we are using a firewall with RedHat kernel 2.4.20-19.7. 

...which has been reported by Red Hat as buggy a few months ago, 
check their errata pages for details.

> Please CC me as I'm not subscribed.

..pity.

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

Re: bug? blocked packets get shadowed to internal network

[Dharmendra.T]

[-- Attachment #1: Type: text/plain, Size: 1697 bytes --]

hi,

When I saw your logs it is sending a rst packet to destination. Are you
running any ids inside your network? 


Regards
Dharmendra.T
dharmu@nsecure.net


On Thu, 2003-08-14 at 15:04, Juergen Stohr wrote:

    Hi to all,
    
    we are using a firewall with RedHat kernel 2.4.20-19.7. The firewall is 
    configured to block every packet with DPT 199 into our network. When doing
    a "telnet server.in.our.network 199" from outside, the firewall correctly 
    drops that packet, logging
    
    IN=eth1 OUT=eth0 SRC=xxx.xxx.11.231 DST=xxx.xxx.151.184 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=12615 DF PROTO=TCP SPT=34869 DPT=199 WINDOW=8760 RES=0x00 SYN URGP=0
    
    to syslog. The external interface is eth1, internal is eth0.
    However, at the same time, the firewall generates a packet, which is droped
    by the output chain of the firewall. It fakes the SRC and DST and wants to send
    that packet to the internal server:
    
    IN= OUT=eth0 SRC=xxx.xxx.151.184 DST=xxx.xxx.11.231 LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=TCP SPT=199 DPT=34869 WINDOW=0 RES=0x00 ACK RST URGP=0
    
    When setting the output chain to accept policy, the above packet is delivered
    xxx.xxx.151.184!
    
    How can we prohibit those packets to be generated? Kernel RH 2.4.18-x didn't
    show that behaviour.
    
    Please CC me as I'm not subscribed.
    
    regards,
    	juergen
    
    

-- 

This message is intended for the addressee only. It may contain
privileged or Confidential information. If you have received this
message in error,please notify the sender and destroy the message
immediately.Unauthorised use or reproduction of this message is strictly
prohibited.

[-- Attachment #2: Type: text/html, Size: 3616 bytes --]