Kernel, IPTables or Router Anomaly? Maybe me?

Kernel, IPTables or Router Anomaly? Maybe me?

[David C. Hart]

[-- Attachment #1: Type: text/plain, Size: 962 bytes --]

I can't figure this out.

Our server has three internal IP addresses on two interfaces. So we have
eth0, eth0:1 and eth1.

"Oct 31 09:24:47 mail2 kernel: FIREWALLED: IN=eth1 OUT=
MAC=00:09:5b:22:29:d1:00:06:25:e4:ed:a3:08:00 SRC=217.97.25.71 DST=192.
168.0.5 LEN=404 TOS=0x00 PREC=0x00 TTL=111 ID=40607 PROTO=UDP SPT=6022
DPT=1434 LEN=384"

In this case, destination 192.168.0.5 is on eth0:1. Yet it shows as eth1
with the eth1 MAC. This connections was NATed through the router so it
never hit the eth1 interface. Here's part of the ifconfig.

eth0      Link encap:Ethernet  HWaddr 00:50:04:65:E3:1B
          inet addr:192.168.0.31  Bcast:192.168.0.255 
Mask:255.255.255.0

eth0:1    Link encap:Ethernet  HWaddr 00:50:04:65:E3:1B
          inet addr:192.168.0.5  Bcast:192.168.0.255  Mask:255.255.255.0

eth1      Link encap:Ethernet  HWaddr 00:09:5B:22:29:D1
          inet addr:192.168.0.32  Bcast:192.168.0.255 
Mask:255.255.255.0


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Kernel, IPTables or Router Anomaly? Maybe me?

[Ramin Dousti]

You have three interfaces on the same 192.168.0.0/24. Why?

On Fri, Oct 31, 2003 at 09:49:37AM -0500, David C. Hart wrote:

> I can't figure this out.
> 
> Our server has three internal IP addresses on two interfaces. So we have
> eth0, eth0:1 and eth1.
> 
> "Oct 31 09:24:47 mail2 kernel: FIREWALLED: IN=eth1 OUT=
> MAC=00:09:5b:22:29:d1:00:06:25:e4:ed:a3:08:00 SRC=217.97.25.71 DST=192.
> 168.0.5 LEN=404 TOS=0x00 PREC=0x00 TTL=111 ID=40607 PROTO=UDP SPT=6022
> DPT=1434 LEN=384"
> 
> In this case, destination 192.168.0.5 is on eth0:1. Yet it shows as eth1
> with the eth1 MAC. This connections was NATed through the router so it
> never hit the eth1 interface. Here's part of the ifconfig.
> 
> eth0      Link encap:Ethernet  HWaddr 00:50:04:65:E3:1B
>           inet addr:192.168.0.31  Bcast:192.168.0.255 
> Mask:255.255.255.0
> 
> eth0:1    Link encap:Ethernet  HWaddr 00:50:04:65:E3:1B
>           inet addr:192.168.0.5  Bcast:192.168.0.255  Mask:255.255.255.0
> 
> eth1      Link encap:Ethernet  HWaddr 00:09:5B:22:29:D1
>           inet addr:192.168.0.32  Bcast:192.168.0.255 
> Mask:255.255.255.0
> 

Re: Kernel, IPTables or Router Anomaly? Maybe me?

[David C. Hart]

[-- Attachment #1: Type: text/plain, Size: 393 bytes --]

On Fri, 2003-10-31 at 14:18, Ramin Dousti wrote:
> You have three interfaces on the same 192.168.0.0/24. Why?
> 
Postfix needs two. While I could create a virtual IP, NIC cards are
cheap enough.

eth0: SMTP Postfix
eth1: HTTP, FTP, etc and Postfix redirects for regex header and body
checks.
eth0:1 A virtual IP used exclusively to direct port scans and other
miscreant traffic to.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Kernel, IPTables or Router Anomaly? Maybe me?

[Ramin Dousti]

OK, first of all don't use ifconfig and the family. Use iproute2.
By doing:

ip addr add 192.168.0.31/24 dev eth0
ip addr add 192.168.0.5/24 dev eth0
ip addr add 192.168.0.32/24 dev eth1

This way you will not have the weird eth0:1 which most probably is
the culprit.

Ramin

On Fri, Oct 31, 2003 at 03:09:26PM -0500, David C. Hart wrote:

> On Fri, 2003-10-31 at 14:18, Ramin Dousti wrote:
> > You have three interfaces on the same 192.168.0.0/24. Why?
> > 
> Postfix needs two. While I could create a virtual IP, NIC cards are
> cheap enough.
> 
> eth0: SMTP Postfix
> eth1: HTTP, FTP, etc and Postfix redirects for regex header and body
> checks.
> eth0:1 A virtual IP used exclusively to direct port scans and other
> miscreant traffic to.

Re: Kernel, IPTables or Router Anomaly? Maybe me?

[David C. Hart]

[-- Attachment #1: Type: text/plain, Size: 750 bytes --]

On Fri, 2003-10-31 at 15:49, Ramin Dousti wrote:
> OK, first of all don't use ifconfig and the family. Use iproute2.
> By doing:
> 
> ip addr add 192.168.0.31/24 dev eth0
> ip addr add 192.168.0.5/24 dev eth0
> ip addr add 192.168.0.32/24 dev eth1
> 
Interesting. Thanks. Meanwhile, I had to shut IPTables down. Something
was causing a problem with the Redhat list server (hormel) and only
hormel.

Somehow - despite no mangle rules - packets from this server were being
rejected - not seen as targeting port 25. As soon as I killed IPTables,
the problem went away. I have more reading to do. A LOT more reading to
do.

For now, we have non-forwarded traffic rejected at the router and I'm
using SNMPDTRAPD to log what's going on.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]