iptables bridge filter question

iptables bridge filter question

[Gerry Weaver]

[-- Attachment #1: Type: text/plain, Size: 767 bytes --]

Hello All,

I have setup a bridging firewall. I want to drop packets on the external
interface, which have source addresses on my internal network. However, the
firewall/bridge sits between my T1 router and the rest of my LAN. Is there a
way to drop the packets mentioned previously, but allow the router? I guess
a rule could be created that uses the routers mac address as a match. I've
been playing around with this, but I'm not getting the result I want. I
could sure use some advice on this.

[ LAN xx.xx.xx.0/24 ]<==>[ bridge/firewall ]<==>[ router xx.xx.xx.254/24 ]


Thanks in advance,
Gerry
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.576 / Virus Database: 365 - Release Date: 1/30/2004

[-- Attachment #2: Type: text/html, Size: 1631 bytes --]

Re: iptables bridge filter question

[Antony Stone]

On Thursday 18 March 2004 8:28 am, Gerry Weaver wrote:

> Hello All,
>
> I have setup a bridging firewall. I want to drop packets on the external
> interface, which have source addresses on my internal network. However, the
> firewall/bridge sits between my T1 router and the rest of my LAN. Is there
> a way to drop the packets mentioned previously, but allow the router? I
> guess a rule could be created that uses the routers mac address as a match.
> I've been playing around with this, but I'm not getting the result I want.
> I could sure use some advice on this.
>
> [ LAN xx.xx.xx.0/24 ]<==>[ bridge/firewall ]<==>[ router xx.xx.xx.254/24 ]

How about:

iptables -A FORWARD -i $extIF -s xx.xx.xx.254 -j ACCEPT
iptables -A FORWARD -i $extIF -s xx.xx.xx.0/24 -j DROP

 ?

Antony.

-- 
Most people have more than the average number of legs.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: iptables bridge filter question

[Antony Stone]

On Thursday 18 March 2004 3:24 pm, Antony Stone wrote:

> On Thursday 18 March 2004 8:28 am, Gerry Weaver wrote:
> > Hello All,
> >
> > I have setup a bridging firewall. I want to drop packets on the external
> > interface, which have source addresses on my internal network. However,
> > the firewall/bridge sits between my T1 router and the rest of my LAN. Is
> > there a way to drop the packets mentioned previously, but allow the
> > router? I guess a rule could be created that uses the routers mac address
> > as a match. I've been playing around with this, but I'm not getting the
> > result I want. I could sure use some advice on this.
> >
> > [ LAN xx.xx.xx.0/24 ]<==>[ bridge/firewall ]<==>[ router xx.xx.xx.254/24
> > ]
>
> How about:
>
> iptables -A FORWARD -i $extIF -s xx.xx.xx.254 -j ACCEPT
> iptables -A FORWARD -i $extIF -s xx.xx.xx.0/24 -j DROP

Okay, scrub that - I overlooked the significance of it being a *bridging* 
firewall :(

Antony.

-- 
All matter in the Universe can be placed into one of two categories:

1. Things which need to be fixed.
2. Things which need to be fixed once you've had a few minutes to play with 
them.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: iptables bridge filter question

[Vincent Haverlant]

Le Thu Mar 18 15:33:58 2004, Antony Stone a écrit:
| > > I have setup a bridging firewall. I want to drop packets on the external
| > > interface, which have source addresses on my internal network. However,
| > > the firewall/bridge sits between my T1 router and the rest of my LAN. Is
| > > there a way to drop the packets mentioned previously, but allow the
| > > router? I guess a rule could be created that uses the routers mac address
| > > as a match. I've been playing around with this, but I'm not getting the
| > > result I want. I could sure use some advice on this.
| > >
| > > [ LAN xx.xx.xx.0/24 ]<==>[ bridge/firewall ]<==>[ router xx.xx.xx.254/24
| > > ]
| >
| > How about:
| >
| > iptables -A FORWARD -i $extIF -s xx.xx.xx.254 -j ACCEPT
| > iptables -A FORWARD -i $extIF -s xx.xx.xx.0/24 -j DROP
| 
| Okay, scrub that - I overlooked the significance of it being a *bridging* 
| firewall :(

Well this is not altogether stupid :) provided you have the bridge-nf
patch for a 2.4 kernel or a 2.6 kernel with bridge filtering and
ebtables.

Vincent.
-- 
   .~.     Vincent Haverlant  -- Galadril -- #ICQ: 35695155   
   /V\      MSN: vincent_msn@haverlant.org  -- http://www.haverlant.org/
  /( )\      Parinux member: http://www.parinux.org/
  ^^-^^       GPG: 8FEA 52C2 5C54 A201 2375  0FA5 AF2E 1881 92D0 EE84

RE: iptables bridge filter question

[Gerry Weaver]

Hi,

Firstly, thanks for the suggestions. Please let me explain further. I want
to setup an anti-spoofing rule that will block packets coming in on the
external interface, which have a source address of my internal net. The
problem is that I have a router that sits in the external side of the
bridge. I need to stop spoofed packets while still allowing my router.
Shouldn't the following allow my router by mac address and then drop
everything else that's coming in with a source address of my internal net?

EXTERNAL_IFACE="eth0"
INTERNAL_NET="10.10.10.0/24"
ROUTER_MAC="00:00:00:00:00:00"

iptables -N tcp_packets
iptables -N udp_packets

iptables -A INPUT -p tcp -i $EXTERNAL_IFACE -j tcp_packets
iptables -A INPUT -p udp -i $EXTERNAL_IFACE -j udp_packets


iptables -A tcp_packets -i eth0 -m mac --mac-source $ROUTER_MAC -j ACCEPT
iptables -A tcp_packets -p tcp -j DROP -s $INTERNAL_NET -j DROP


iptables -A udp_packets -i eth0 -m mac --mac-source $ROUTER_MAC -j ACCEPT
iptables -A udp_packets -p udp -j DROP -s $INTERNAL_NET -j DROP

Thanks,
Gerry







[Gerry Weaver]  -----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Gerry Weaver
Sent: Thursday, March 18, 2004 2:28 AM
To: netfilter@lists.netfilter.org
Subject: iptables bridge filter question


Hello All,

I have setup a bridging firewall. I want to drop packets on the external
interface, which have source addresses on my internal network. However, the
firewall/bridge sits between my T1 router and the rest of my LAN. Is there a
way to drop the packets mentioned previously, but allow the router? I guess
a rule could be created that uses the routers mac address as a match. I've
been playing around with this, but I'm not getting the result I want. I
could sure use some advice on this.

[ LAN xx.xx.xx.0/24 ]<==>[ bridge/firewall ]<==>[ router xx.xx.xx.254/24 ]


Thanks in advance,
Gerry
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.576 / Virus Database: 365 - Release Date: 1/30/2004

Re: iptables bridge filter question

[Antony Stone]

On Thursday 18 March 2004 8:12 pm, Gerry Weaver wrote:

> Hi,
>
> Firstly, thanks for the suggestions. Please let me explain further. I want
> to setup an anti-spoofing rule that will block packets coming in on the
> external interface, which have a source address of my internal net. The
> problem is that I have a router that sits in the external side of the
> bridge. I need to stop spoofed packets while still allowing my router.

Question:

Why are you expecting to see packets coming from your router which have the 
source address of the router's internal interface?

I agree that any packets *originating* from the router (including replies to 
any packets you send to it) will have this address, but are you really 
expecting such traffic?

Most of the packets you see coming from your router will have source addresses 
out on the Internet (that, after all, is what the router is for), so it may 
be that you don't have the "unique address" problem after all?

Regards,

Antony.

-- 
The first fifty percent of an engineering project takes ninety percent of the 
time, and the remaining fifty percent takes another ninety percent of the 
time.

                                                     Please reply to the list;
                                                           please don't CC me.

RE: iptables bridge filter question

[Gerry Weaver]

Hi,

I understand what your suggesting. Perhaps I still didn't explain well
enough. Here's an example:

[NodeA 10.10.10.1]<==>[Firewall 10.10.10.2]<==>[Router 10.10.10.254]

If the router is setup as the default gateway for NodeA then wouldn't it be
sending packets with a source address on the 10.10.10.0 network through the
external interface of the bridge. If I created a rule which dropped any
packets that arrived at the external Firewall interface, with a source
address on the 10.10.10.0 network, would that be a problem? I'm not saying
your wrong. I'm just trying to understand my misunderstanding.

Thanks,
Gerry

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Antony Stone
Sent: Thursday, March 18, 2004 2:40 PM
To: netfilter@lists.netfilter.org
Subject: Re: iptables bridge filter question


On Thursday 18 March 2004 8:12 pm, Gerry Weaver wrote:

> Hi,
>
> Firstly, thanks for the suggestions. Please let me explain further. I want
> to setup an anti-spoofing rule that will block packets coming in on the
> external interface, which have a source address of my internal net. The
> problem is that I have a router that sits in the external side of the
> bridge. I need to stop spoofed packets while still allowing my router.

Question:

Why are you expecting to see packets coming from your router which have the
source address of the router's internal interface?

I agree that any packets *originating* from the router (including replies to
any packets you send to it) will have this address, but are you really
expecting such traffic?

Most of the packets you see coming from your router will have source
addresses
out on the Internet (that, after all, is what the router is for), so it may
be that you don't have the "unique address" problem after all?

Regards,

Antony.

--
The first fifty percent of an engineering project takes ninety percent of
the
time, and the remaining fifty percent takes another ninety percent of the
time.

                                                     Please reply to the
list;
                                                           please don't CC
me.



---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.576 / Virus Database: 365 - Release Date: 1/30/2004

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.576 / Virus Database: 365 - Release Date: 1/30/2004

Re: iptables bridge filter question

[Antony Stone]

On Thursday 18 March 2004 11:09 pm, Gerry Weaver wrote:

> Hi,
>
> I understand what your suggesting. Perhaps I still didn't explain well
> enough. Here's an example:
>
> [NodeA 10.10.10.1]<==>[Firewall 10.10.10.2]<==>[Router 10.10.10.254]
>
> If the router is setup as the default gateway for NodeA then wouldn't it be
> sending packets with a source address on the 10.10.10.0 network through the
> external interface of the bridge.

No, I don't think so.

I assume three things here (please let me know if I'm wrong):

1. The router IS performing source nat on outbound packets (so that packets 
which end up on the Internet have a public routable source address rather 
than something within 10.10.10.0/24).

2. The router is NOT performing source nat on inbound packets coming from the 
Internet (so that packets arriving on your local network have the correct 
source address of the machine they came from, out in the Big Wide World).

3. You have no great interest in talking to your router from local network 
machines - they want to talk to the Rest Of The World, which is on the other 
side of the router.

Now, if all the above assumptions are true, then valid packets arriving at 
your network through the router from the Internet will have the source 
addresses of the machines they came from, not the internal address of the 
router.

If, for some rather obscure reason, your router is performing source nat on 
incoming packets, then yes, they will have 10.10.10.254 as their source 
address, but I really can't think why this would be the case.

Regards,

Antony.

-- 
One good tern deserves another.
                                                     Please reply to the list;
                                                           please don't CC me.

RE: iptables bridge filter question

[Steve Jones]

[-- Attachment #1: Type: text/plain, Size: 1907 bytes --]

I don't think I'm entirely clear about what you are trying to block, but
I *THINK* I just went through the learning curve to do a similar thing
myself, and was successful.  Check out ebtables.sourceforge.net.  My
requirement was to put a transparent bridge between a router and a
switch, to block or allow CERTAIN traffic based on source and/or
destination IP addresses.  My particular scenario would have been more
appropriately handled by standard iptables, except for that I don't
control the network configuration, so I couldn't change any IP
addresses.
 
Basically, I downloaded the latest ebtables user space utilities, and
the kernel source for 2.6.4, compiled it on my fresh RH9 box, then
compiled the ebtables tools.  Ebtables then gave me the ability to
filter packets at layer two, while bridging.

I'm not at the site today where the firewall is, but I'm going to be
VPNing in later to get the small scripts I used.  Let me know if you
want me to send them as an example.
 
-Steve
 
________________________________

From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Gerry Weaver
Sent: Thursday, March 18, 2004 3:28 AM
To: netfilter@lists.netfilter.org
Subject: iptables bridge filter question
 
Hello All,
 
I have setup a bridging firewall. I want to drop packets on the external
interface, which have source addresses on my internal network. However,
the firewall/bridge sits between my T1 router and the rest of my LAN. Is
there a way to drop the packets mentioned previously, but allow the
router? I guess a rule could be created that uses the routers mac
address as a match. I've been playing around with this, but I'm not
getting the result I want. I could sure use some advice on this.
 
[ LAN xx.xx.xx.0/24 ]<==>[ bridge/firewall ]<==>[ router xx.xx.xx.254/24
]
 
 
Thanks in advance,
Gerry

[-- Attachment #2: Type: text/html, Size: 8651 bytes --]