help accepting unbound addresses

help accepting unbound addresses

[Phil C]

I am using iptables-1.2.8, iproute-2.4.7 and kernel-2.4.25 (stock except
new e1000 driver) running on redhat-7.3.

I have a machine running stunnel on 0.0.0.0:443, which has a private address
(192.168.1.1) and a public address (1.2.3.4). I want to accept port 443 traffic
for an unbound subnet (12.12.12.0/24). Generally speaking this would be easy
enough, simply bind the subnet to the loopback.. But there are other
constraints...

I have made some modifications to stunnel. First, stunnel now uses
getsockname() to determine what cert to load from the file system. This means
that I can't use destination nat'ing, because I need the destination IP to
remain in tact. The second complication is that I have added a new option to
stunnel which allows it to connect back to the original destination address (ie
12.12.12.3), but on port 80. This means that the subnet can't be on the
loopback, because when stunnel tries to reconnect to port 80 the request will
be seen as local and it won't get back to the proper box (no http process on my
stunnel box).

My attempts to have the packet accepted locally and routed back out of the
stunnel box have thus far been fruitless. I tried using tproxy, but of course,
that modifies the destination address. I have also tried the following:

iptables -t mangle -A PREROUTING -j MARK -i eth0.26 -p tcp --dport 443 --set-mark 0xa
ip rule add prio 10 fwmark 10 table 10
ip route add 0/0 dev lo table 10

The packets make it to the stunnel machine, but the client only receives
icmp time exceeded in-transit.

I also tried this

iptables -t mangle -A PREROUTING -j MARK -p tcp --dport 80 --set-mark 0x14
ip rule add prio 20 fwmark 20 table 20
ip route add 0/0 via [DEFROUTE] table 20

This yields the same result as the above.

Soooo... is it possible to accept packets for an unbound IP, without
modifying the original destination address? If nothing exists right now
to do such a thing, are there any projects/features which could be modified
to accomodate these requirements? I've exhausted my knowledge base trying
to solve this problem. Any tips hints... anything would be helpful.

Thanks

-- 
<flah@hell.com>
0x68616c666

Re: help accepting unbound addresses

[Phil C]

As a follow up to my initial questions, I began looking into the possible
viability of using libipq and the QUEUE target. Right now I'm using the
example provided in the man page, but with the same results... The packets are
looping and eventually producing icmp in-transit timeouts.

I thought that doing an ipq_set_verdict() would allow the packet to actually
be accepted, short circuiting the rest of the kernel processing of the
packet... It appears that this is not the case, or am I missing something?

Again, all I really need to do it accept traffic for addresses that aren't
bound to any interfaces, without modifying the original destination address.
It seems that one way or another, this must be possible.

-- 
<flah@hell.com>
\x104\x97\x108\x102

Re: help accepting unbound addresses

[Phil C]

A temporary resolution to my question, which is far from ideal (not very
scalable):

Put subnets on the loopback, to accept packets as they come in on 443.
Add a DNAT rule, for the but bound port 80 traffic, which routes traffic
out to the correct destination.

I was really hoping for something far more dynamic than this, but it'll have
to do in a pinch. The ideal solution would be to simply accept any packet
on a single interface and deliver it as local (without modifying the destination
address). That would allow me to simply route new subnets to my stunnel box
and have 0 configuration updates on the stunnel box, but alas it doesn't seem
feasible. :(

If anyone has any suggestions, please let me know.

-- 
<flah@hell.com>
01101000011000010110110001100110