RE: DNAT problem / question (nfcan: addressed to exclusive sender for this address)

RE: DNAT problem / question (nfcan: addressed to exclusive sender for this address)

[Arnauts, Bert]

 Thx Jim,

$IPTABLES -t nat -A PREROUTING -d 172.25.239.220 -j DNAT
--to-destination 11.0.0.16

I tried this rule. Firt I made a virtual interface on the external
network, then I executed my rules. (see below)
I still have access to my nat box now, (the 208), but I can not ping the
220 anymore. Apparently he forwards something ?
(3 packets ?) Is my broadcast address right ? I made this the same as
the nat box has ? What does this anyway ?

What about the subnetmask of my internal network  ? 255.255.255.224 ??
Will the nat rule know this ?

Cheers, and thx,

Bert



------------------------------------------------------------------------
-----------------------
eth1      Link encap:Ethernet  HWaddr 00:D0:B7:E0:1F:2C  
          inet addr:172.25.239.208  Bcast:172.25.239.223
Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:33527 errors:0 dropped:0 overruns:0 frame:0
          TX packets:791 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1944722 (1.8 Mb)  TX bytes:113877 (111.2 Kb)
          Interrupt:11 Base address:0xd400 Memory:fa000000-fa000038 

eth1:1    Link encap:Ethernet  HWaddr 00:D0:B7:E0:1F:2C  
          inet addr:172.25.239.220  Bcast:172.25.239.223
Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
          Interrupt:11 Base address:0xd400 Memory:fa000000-fa000038 
------------------------------------------------------------------------
---------------------------
[root@linuxrouter root]# iptables -L -t nat -nvx
Chain PREROUTING (policy ACCEPT 241 packets, 40673 bytes)
    pkts      bytes target     prot opt in     out     source
destination         
       7      678 DNAT       all  --  *      *       0.0.0.0/0
172.25.239.220     to:11.0.0.16 

Chain POSTROUTING (policy ACCEPT 17 packets, 1403 bytes)
    pkts      bytes target     prot opt in     out     source
destination         

Chain OUTPUT (policy ACCEPT 6 packets, 461 bytes)
    pkts      bytes target     prot opt in     out     source
destination 
------------------------------------------------------------------------
---------------------------        
[root@linuxrouter root]# iptables -L -nvx
Chain INPUT (policy ACCEPT 51 packets, 5884 bytes)
    pkts      bytes target     prot opt in     out     source
destination         
     149    12360 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source
destination         
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED 
      24     1837 RULE_0     all  --  *      *       0.0.0.0/0
11.0.0.16          state NEW 

Chain OUTPUT (policy ACCEPT 1 packets, 152 bytes)
    pkts      bytes target     prot opt in     out     source
destination         
     116    26168 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          state RELATED,ESTABLISHED 
       0        0 RULE_0     all  --  *      *       0.0.0.0/0
11.0.0.16          state NEW 

Chain RULE_0 (2 references)
    pkts      bytes target     prot opt in     out     source
destination         
      24     1837 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 6 prefix `RULE 0 -- ACCEPT ' 
      24     1837 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0          
------------------------------------------------------------------------
----------------------- 
[root@linuxrouter root]# arp -an
? (172.25.239.193) at 00:60:47:40:F7:A5 [ether] on eth1
? (11.0.0.16) at 00:E0:18:02:38:60 [ether] on eth0
[root@linuxrouter root]# 


-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Jim Laurino
Sent: Monday, June 21, 2004 6:25 AM
To: netfilter@lists.netfilter.org
Subject: Re: DNAT problem / question (nfcan: addressed to exclusive
sender for this address)

On 2004.06.20 18:24, Arnauts Bert  - Bert.Arnauts@fujitsu- siemens.com
wrote:
> Hello all,
> 
> thx already for the hints, but I am still in a strugle.
> I changed my destination ip to 207,
> because 220 could cause problems.
> Forgive me that I don't understand why.
> Anyway, these rules give even a more confusing result.
> I am still not able to access my 11.0.0.16 box through the 
> 172.25.239.207 DNAT'ed alias.
> (not pingable, not nothing)
> I also can not connect anymore to my netfilter box anymore after 
> executing this script, BUT my active ssh connection stays open ! ?
> I am still on my machine remotly,
> but I can not ping it anymore ?? :(
> 
> Any more ideas ?
> ------------------------------------------------------------
> 
> echo "Activating firewall script generated Thu Jun 10 15:03:22 2004 
> CEST by root"
> 
> $IPTABLES -t nat -A PREROUTING -d 172.25.239.207/27 -j DNAT 
> --to-destination 11.0.0.16
> 
> $IPTABLES -A INPUT   -m state --state
> NEW,ESTABLISHED,RELATED -j ACCEPT
> $IPTABLES -A OUTPUT  -m state --state
> NEW,ESTABLISHED,RELATED -j ACCEPT
> $IPTABLES -A FORWARD -m state --state
> NEW,ESTABLISHED,RELATED -j ACCEPT
> 
> $IPTABLES -N RULE_0
> $IPTABLES -A OUTPUT  -d 11.0.0.16  -m state --state NEW
> - j RULE_0
> $IPTABLES -A FORWARD -d 11.0.0.16  -m state --state NEW -j RULE_0 
> $IPTABLES -A RULE_0  -j LOG --log-level info --log-prefix "RULE 0 -- 
> ACCEPT "
> $IPTABLES -A RULE_0  -j ACCEPT
> echo 1 > /proc/sys/net/ipv4/ip_forward
> 
> execution of this script gives me this :
> (why is there 192 ? in stead of 207 ?)

> [root@linuxrouter root]# iptables -t nat -L Chain PREROUTING (policy 
> ACCEPT)
> target     prot opt source               destination
> 
> DNAT       all  --  anywhere              
> 172.25.239.192/27 to:11.0.0.16

Because the programmers were being kind to you :) The 192 is the base
address for the range 192-223, and is exactly what you need for a
.207/27.
(That is, the low 5 bits need to be zeros.)

It will be less confusing, later,
if you change your rule to:

$IPTABLES -t nat -A PREROUTING -d 172.25.239.192/27 -j DNAT
--to-destination 11.0.0.16 (but see below, I think you may not mean to
do this)

If you change the List command from:

iptables -t nat -L
to
iptables -t nat -L -nvx

The -v (--verbose) and -x (--exact) flags will give you (among other
things) the exact number of packets that have matched each rule.

To look at the main (filter) table do:
iptables -L -nvx

I think that you will see that all packets here match these first rules:

-m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Therefore the "Rule 0" test, which comes later, will never get a chance
to look at them, and will have a zero count.

Change those first rules to:

-m state --state ESTABLISHED,RELATED -j ACCEPT

Then the "Rule 0" tests will match NEW packets.

The PREROUTING rule says that any packet addressed to 172.25.239.207
will be changed to a destination address of 11.0.0.16.
(In fact any address 172.25.239.192 through
172.25.239.223 will become 11.0.0.16)

Therefore, when a packet originally addressed to 172.25.239.207 (in on
eth1) arrives (later) at the filter table it will have a destination
address 11.0.0.16 and will traverse the FORWARD chain and leave by eth0.
Only the host with that address (.16) will receive packets.
This explains why the netfilter host is inacessible.

Also, you said:

> I have everything in the 172.25.239.0/27 network.

This must be a typo, because this does not include 172.25.239.207, which
is one of the 31 addresses in the 172.25.239.192/27 network.

From other things you have said,
I think you may be trying to translate a series of addresses exactly one
to one:

172.25.239.207 <--> 11.0.0.16

I think you can best do this by using an explicit PREROUTING rule for
each pair.
That is, get rid of the /27,
and add a rule for each address pair.
Then you can keep, say .208, not translated, and allow this to be used
as the address of the netfilter host. Like this:

$IPTABLES -t nat -A PREROUTING -d 172.25.239.207 -j DNAT
--to-destination 11.0.0.16

Jim

Help with alias interfaces

[Erick Sanz]

	All,

	I have multiple interfaces in a system (eth1, eth1:0, eth1:1 and eth1:2),
and I need to forward things for several ports to them.

	Since IPtables do not understand eth1:1, my rules look something like
this:

# Ftp server
    iptables -t nat -A PREROUTING -p tcp -d $FTP_IPADDR --dport 21 -j
DNAT --to $FTP_SERVER
    iptables -A FORWARD -i eth1 -p tcp -d $FTP_SERVER --dport 21 -m
state --state NEW -j ACCEPT

# Web server
    iptables -t nat -A PREROUTING -p tcp -d $WEB_IPADDR --dport 80 -j
DNAT --to $WEB_SERVER
    iptables -A FORWARD -i eth1 -p tcp -d $WEB_SERVER --dport 80 -m
state --state NEW -j ACCEPT

	eth1 is my WAN interface... Is this correct?

	Also, for the life of my I don't seem to be able to get DNS resulution to
my
DNS server; my rules are as follows:

    iptables -t nat -A PREROUTING -p udp -d $DNS_1 --dport 53 -j DNAT --to
$DNS_SERVER1
    iptables -t nat -A PREROUTING -p tcp -d $DNS_1 --dport 53 -j DNAT --to
$DNS_SERVER1

    iptables -t nat -A PREROUTING -p udp -d $DNS_2 --dport 53 -j DNAT --to
$DNS_SERVER2
    iptables -t nat -A PREROUTING -p tcp -d $DNS_2 --dport 53 -j DNAT --to
$DNS_SERVER2

    iptables -A FORWARD -i eth1 -p udp -d $DNS_SERVER1 --dport 53 -m
state --state NEW -j ACCEPT
    iptables -A FORWARD -i eth1 -p tcp -d $DNS_SERVER1 --dport 53 -m
state --state NEW -j ACCEPT

    iptables -A FORWARD -i eth1 -p udp -d $DNS_SERVER2 --dport 53 -m
state --state NEW -j ACCEPT
    iptables -A FORWARD -i eth1 -p tcp -d $DNS_SERVER2 --dport 53 -m
state --state NEW -j ACCEPT

	Besides those rules, I also allow ping to those interfaces.

	Does anybody host their own DNS, if so, could you share your rules (without
IP addresses, to protect the identity of the inocent...)    ;)

	Beforehand, thank you for your help!

Best regards,
Erick Sanz



This email message has been scanned for viruses.

Re: Help with alias interfaces

[Paweł Staszewski]

Hello
Try this:
ip link set eth0:x name shit1

and then...
iptables -A FORWARD -i shit1 -do something


----- Original Message ----- 
From: "Erick Sanz" <esanz@minorplanetusa.com>
To: <netfilter@lists.netfilter.org>
Sent: Monday, June 21, 2004 6:45 PM
Subject: Help with alias interfaces


>
> All,
>
> I have multiple interfaces in a system (eth1, eth1:0, eth1:1 and eth1:2),
> and I need to forward things for several ports to them.
>
> Since IPtables do not understand eth1:1, my rules look something like
> this:
>
> # Ftp server
>     iptables -t nat -A PREROUTING -p tcp -d $FTP_IPADDR --dport 21 -j
> DNAT --to $FTP_SERVER
>     iptables -A FORWARD -i eth1 -p tcp -d $FTP_SERVER --dport 21 -m
> state --state NEW -j ACCEPT
>
> # Web server
>     iptables -t nat -A PREROUTING -p tcp -d $WEB_IPADDR --dport 80 -j
> DNAT --to $WEB_SERVER
>     iptables -A FORWARD -i eth1 -p tcp -d $WEB_SERVER --dport 80 -m
> state --state NEW -j ACCEPT
>
> eth1 is my WAN interface... Is this correct?
>
> Also, for the life of my I don't seem to be able to get DNS resulution to
> my
> DNS server; my rules are as follows:
>
>     iptables -t nat -A PREROUTING -p udp -d $DNS_1 --dport 53 -j DNAT --to
> $DNS_SERVER1
>     iptables -t nat -A PREROUTING -p tcp -d $DNS_1 --dport 53 -j DNAT --to
> $DNS_SERVER1
>
>     iptables -t nat -A PREROUTING -p udp -d $DNS_2 --dport 53 -j DNAT --to
> $DNS_SERVER2
>     iptables -t nat -A PREROUTING -p tcp -d $DNS_2 --dport 53 -j DNAT --to
> $DNS_SERVER2
>
>     iptables -A FORWARD -i eth1 -p udp -d $DNS_SERVER1 --dport 53 -m
> state --state NEW -j ACCEPT
>     iptables -A FORWARD -i eth1 -p tcp -d $DNS_SERVER1 --dport 53 -m
> state --state NEW -j ACCEPT
>
>     iptables -A FORWARD -i eth1 -p udp -d $DNS_SERVER2 --dport 53 -m
> state --state NEW -j ACCEPT
>     iptables -A FORWARD -i eth1 -p tcp -d $DNS_SERVER2 --dport 53 -m
> state --state NEW -j ACCEPT
>
> Besides those rules, I also allow ping to those interfaces.
>
> Does anybody host their own DNS, if so, could you share your rules
(without
> IP addresses, to protect the identity of the inocent...)    ;)
>
> Beforehand, thank you for your help!
>
> Best regards,
> Erick Sanz
>
>
>
> This email message has been scanned for viruses.
>
>
>
>

Re: Help with alias interfaces

[mlody]

> Hello
> Try this:
> ip link set eth0:x name shit1
> 
> and then...
> iptables -A FORWARD -i shit1 -do something
> 
> 

I did "ip link set eth0:1 name ble1" and I get respond: "SIOCSIFNAME: 
Device or resource busy"

eth0 is up and eth0:1 is down. Where is the hatch?

Robert

Re: Help with alias interfaces

[Paweł Staszewski]

Try ifconfig eth0:1 down and delete ip's from that interface and then "ip
link set eth0:1 name ble1"
----- Original Message ----- 
From: <mlody@elpec.com>
To: <netfilter@lists.netfilter.org>
Sent: Monday, June 21, 2004 8:22 PM
Subject: Re: Help with alias interfaces


> > Hello
> > Try this:
> > ip link set eth0:x name shit1
> >
> > and then...
> > iptables -A FORWARD -i shit1 -do something
> >
> >
>
> I did "ip link set eth0:1 name ble1" and I get respond: "SIOCSIFNAME:
> Device or resource busy"
>
> eth0 is up and eth0:1 is down. Where is the hatch?
>
> Robert
>
>
>
>

Re: Help with alias interfaces

[mlody]

> Try ifconfig eth0:1 down and delete ip's from that interface and then "ip
> link set eth0:1 name ble1"
> ----- Original Message ----- 
> From: <mlody@elpec.com>
> To: <netfilter@lists.netfilter.org>
> Sent: Monday, June 21, 2004 8:22 PM
> Subject: Re: Help with alias interfaces
> 
> 
> > > Hello
> > > Try this:
> > > ip link set eth0:x name shit1
> > >
> > > and then...
> > > iptables -A FORWARD -i shit1 -do something
> > >
> > >
> >
> > I did "ip link set eth0:1 name ble1" and I get respond: "SIOCSIFNAME:
> > Device or resource busy"
> >
> > eth0 is up and eth0:1 is down. Where is the hatch?
> >
> > Robert
> >
> >
> >
> >
> 
> 
> 
 The problem is that eth0:1 is down. Unless you men eth0 is to down...

Robert

Help with alias interfaces

[Erick Sanz]

	All,

	I tried the suggested solution with no luck...  Also,
I did not hear from anybody hosting DNS...

	Does anybody else have any ideas for the original post?

	Original post bellow.

Best regards,
Erick Sanz



> 
> 
> 	All,
> 
> 	I have multiple interfaces in a system (eth1, eth1:0, 
> eth1:1 and eth1:2),
> and I need to forward things for several ports to them.
> 
> 	Since IPtables do not understand eth1:1, my rules look 
> something like
> this:
> 
> # Ftp server
>     iptables -t nat -A PREROUTING -p tcp -d $FTP_IPADDR --dport 
> 21 -j DNAT --to $FTP_SERVER
>     iptables -A FORWARD -i eth1 -p tcp -d $FTP_SERVER --dport 21 
> -m state --state NEW -j ACCEPT
> 
> # Web server
>     iptables -t nat -A PREROUTING -p tcp -d $WEB_IPADDR --dport 
> 80 -j DNAT --to $WEB_SERVER
>     iptables -A FORWARD -i eth1 -p tcp -d $WEB_SERVER --dport 80 
> -m state --state NEW -j ACCEPT
> 
> 	eth1 is my WAN interface... Is this correct?
> 
> 	Also, for the life of my I don't seem to be able to get DNS 
> resulution to my
> DNS server; my rules are as follows:
> 
>     iptables -t nat -A PREROUTING -p udp -d $DNS_1 --dport 53 -j 
> DNAT --to $DNS_SERVER1
>     iptables -t nat -A PREROUTING -p tcp -d $DNS_1 --dport 53 -j 
> DNAT --to $DNS_SERVER1
> 
>     iptables -t nat -A PREROUTING -p udp -d $DNS_2 --dport 53 -j 
> DNAT --to $DNS_SERVER2
>     iptables -t nat -A PREROUTING -p tcp -d $DNS_2 --dport 53 -j 
> DNAT --to $DNS_SERVER2
> 
>     iptables -A FORWARD -i eth1 -p udp -d $DNS_SERVER1 --dport 53 
> -m state --state NEW -j ACCEPT
>     iptables -A FORWARD -i eth1 -p tcp -d $DNS_SERVER1 --dport 53 
> -m state --state NEW -j ACCEPT
> 
>     iptables -A FORWARD -i eth1 -p udp -d $DNS_SERVER2 --dport 53 
> -m state --state NEW -j ACCEPT
>     iptables -A FORWARD -i eth1 -p tcp -d $DNS_SERVER2 --dport 53 
> -m state --state NEW -j ACCEPT
> 
> 	Besides those rules, I also allow ping to those interfaces.
> 
> 	Does anybody host their own DNS, if so, could you share 
> your rules (without
> IP addresses, to protect the identity of the inocent...)    ;)
> 
> 	Beforehand, thank you for your help!
> 
> Best regards,
> Erick Sanz
> 


This email message has been scanned for viruses.

Re: Help with alias interfaces

[Antony Stone]

On Wednesday 23 June 2004 4:31 pm, Erick Sanz wrote:

> All,
>
> 	I tried the suggested solution with no luck...  Also,
> I did not hear from anybody hosting DNS...

Multiple IPs on a single interface are nothing special for netfilter.

The deprecated way to get multiple IPs results in pseudo-interface names such 
as eth1:0, eth1:1 etc as you discussed.   The recommended way to assign 
multiple IPs on one interface (ip addr add a.b.c.d dev eth1) simply results 
in multiple IPs on the interface - no strange new names appear, therefore I 
think it is a much more obvious and clear way of doing it.

Either way, once you are configuring your netfilter rules, you simply refer to 
the simple interface name (eg eth1).   It makes no difference to netfilter 
which method you used to get the multiple addresses assigned.

Also, I see nothing wrong with your DNS rules - there's nothing special about 
getting packets to a DNS server NATted and FORWARDed (so long as you remember 
it uses both UDP and TCP, which you have).   Other than that, it's just the 
same as doing this for a web server, mail server, etc.

Do you have other such servers which *are* working properly with NAT and 
FORWARDing?   If so, is there any obvious difference about the rules, the 
routing, or the machines which can / cannot access the appropriate servers?

Regards,

Antony.

> 	Original post below.
>
> Best regards,
> Erick Sanz
>
> > 	All,
> >
> > 	I have multiple interfaces in a system (eth1, eth1:0,
> > eth1:1 and eth1:2),
> > and I need to forward things for several ports to them.
> >
> > 	Since IPtables do not understand eth1:1, my rules look
> > something like
> > this:
> >
> > # Ftp server
> >     iptables -t nat -A PREROUTING -p tcp -d $FTP_IPADDR --dport
> > 21 -j DNAT --to $FTP_SERVER
> >     iptables -A FORWARD -i eth1 -p tcp -d $FTP_SERVER --dport 21
> > -m state --state NEW -j ACCEPT
> >
> > # Web server
> >     iptables -t nat -A PREROUTING -p tcp -d $WEB_IPADDR --dport
> > 80 -j DNAT --to $WEB_SERVER
> >     iptables -A FORWARD -i eth1 -p tcp -d $WEB_SERVER --dport 80
> > -m state --state NEW -j ACCEPT
> >
> > 	eth1 is my WAN interface... Is this correct?
> >
> > 	Also, for the life of my I don't seem to be able to get DNS
> > resulution to my
> > DNS server; my rules are as follows:
> >
> >     iptables -t nat -A PREROUTING -p udp -d $DNS_1 --dport 53 -j
> > DNAT --to $DNS_SERVER1
> >     iptables -t nat -A PREROUTING -p tcp -d $DNS_1 --dport 53 -j
> > DNAT --to $DNS_SERVER1
> >
> >     iptables -t nat -A PREROUTING -p udp -d $DNS_2 --dport 53 -j
> > DNAT --to $DNS_SERVER2
> >     iptables -t nat -A PREROUTING -p tcp -d $DNS_2 --dport 53 -j
> > DNAT --to $DNS_SERVER2
> >
> >     iptables -A FORWARD -i eth1 -p udp -d $DNS_SERVER1 --dport 53
> > -m state --state NEW -j ACCEPT
> >     iptables -A FORWARD -i eth1 -p tcp -d $DNS_SERVER1 --dport 53
> > -m state --state NEW -j ACCEPT
> >
> >     iptables -A FORWARD -i eth1 -p udp -d $DNS_SERVER2 --dport 53
> > -m state --state NEW -j ACCEPT
> >     iptables -A FORWARD -i eth1 -p tcp -d $DNS_SERVER2 --dport 53
> > -m state --state NEW -j ACCEPT
> >
> > 	Besides those rules, I also allow ping to those interfaces.
> >
> > 	Does anybody host their own DNS, if so, could you share
> > your rules (without
> > IP addresses, to protect the identity of the inocent...)    ;)
> >
> > 	Beforehand, thank you for your help!
> >
> > Best regards,
> > Erick Sanz
>
> This email message has been scanned for viruses.

-- 
"There is no reason for any individual to have a computer in their home."

 - Ken Olsen, President of Digital Equipment Corporation (DEC, later consumed 
by Compaq, later merged with HP)

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Help with alias interfaces

[Dick St.Peters]

Antony Stone writes:
> The deprecated way to get multiple IPs results in pseudo-interface names such 
> as eth1:0, eth1:1 etc as you discussed.

Deprecated by whom?  I use secondary IPs a lot, and I've never before
heard anyone call the standard way of doing them "deprecated".  Plus
I, for one, prefer having pseduo-interface labels for manipulating
them.  Labels are handy, especially if you use names instead of
numbers.  (eth0:bob is as valid as eth0:1.)

>   The recommended way to assign 
> multiple IPs on one interface (ip addr add a.b.c.d dev eth1) simply results 
> in multiple IPs on the interface - no strange new names appear, therefore I 
> think it is a much more obvious and clear way of doing it.

This is probably a case where context and background determine what is
more "obvious" and "clear".  For me, not having those labels would
mean an enormous amount of work.  My administration scripts use, on a
many times daily basis, a small utility that does an SIOCGIFCONF ioctl
to get an array of interfaces.  They sometimes use an alias interface
label to ifconfig the alias interface down.  Without separate labels,
these scripts would turn off the physical interface ... not good!  I
would have to chase down all such instances in a lot of scripts on
many systems.

(BTW, I wrote that utility for SunOS and Ultrix in April 1988, and it
still works for Linux 2.6, with only a couple minor changes.  By far
the largest change is that Linux doesn't return a sorted array,
requiring a qsort() call for neatness.)

--
Dick St.Peters, stpeters@NetHeaven.com 
Gatekeeper, NetHeaven, Saratoga Springs, NY

Re: Help with alias interfaces

[Antony Stone]

On Wednesday 23 June 2004 8:01 pm, Dick St.Peters wrote:

> Antony Stone writes:
> > The deprecated way to get multiple IPs results in pseudo-interface names
> > such as eth1:0, eth1:1 etc as you discussed.
>
> Deprecated by whom?

http://mirrors.bieringer.de/Linux+IPv6-HOWTO/conf-ipv6-in-ipv4-point-to-point-tunnels.html
(Section headings 9.3.1.1 & 9.3.1.2)
http://seclists.org/lists/honeypots/2004/Jan-Mar/0209.html
http://www.uwsg.iu.edu/hypermail/linux/kernel/0108.2/0485.html

>  I use secondary IPs a lot, and I've never before
> heard anyone call the standard way of doing them "deprecated".  Plus
> I, for one, prefer having pseduo-interface labels for manipulating
> them.  Labels are handy, especially if you use names instead of
> numbers.  (eth0:bob is as valid as eth0:1.)

That's what the "ip link set <device> name <name>" is for now :)

> > The recommended way to assign
> > multiple IPs on one interface (ip addr add a.b.c.d dev eth1) simply
> > results in multiple IPs on the interface - no strange new names appear,
> > therefore I think it is a much more obvious and clear way of doing it.
>
> This is probably a case where context and background determine what is
> more "obvious" and "clear".

Agreed.

Antony.

-- 
Ramdisk is not an installation procedure.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Help with alias interfaces

[Dick St.Peters]

Antony Stone writes:

> On Wednesday 23 June 2004 8:01 pm, Dick St.Peters wrote:
> 
> > Antony Stone writes:
> > > The deprecated way to get multiple IPs results in pseudo-interface names
> > > such as eth1:0, eth1:1 etc as you discussed.
> >
> > Deprecated by whom?
> 
> http://mirrors.bieringer.de/Linux+IPv6-HOWTO/conf-ipv6-in-ipv4-point-to-point-tunnels.html
> (Section headings 9.3.1.1 & 9.3.1.2)
> http://seclists.org/lists/honeypots/2004/Jan-Mar/0209.html
> http://www.uwsg.iu.edu/hypermail/linux/kernel/0108.2/0485.html

These are deprecating the use of "ifconfig", not the use of
pseudo-interface names.  You can use pseudo-interface names with "ip":
	     ip addr add dev eth0 a.b.c.d/e label eth0:1

What's more, the author of the last of your references doesn't seem to
be aware that the labels aren't limited to numbers.  His remark about
the number of labels being limited to <10000 doesn't take into account
labels eth0:aaaa through eth0:ZZZZ.  Even that's not all; labels like
eth0:/^%# are allowed too.  I suspect non-printing characters will
work also, although I haven't tried any yet.

As additional icing on this "ip" cake, you can assign multiple IPs to
a single pseudo-interface label, making it possible to deal with
groups of IPs at once.

However, most people aren't dealing with ipv6-in-ipv4 tunnels,
honeypots, or thousands of IPs per interface, as are the references
you cite.  "ifconfig" will handle the vast majority of cases and is
simpler to use when the power of "ip" is not needed.

--
Dick St.Peters, stpeters@NetHeaven.com 

Re: Help with alias interfaces

[Antony Stone]

On Wednesday 23 June 2004 9:30 pm, Dick St.Peters wrote:

> Antony Stone writes:
> > >
> > > > The deprecated way to get multiple IPs results in pseudo-interface
> > > > names such as eth1:0, eth1:1 etc as you discussed.
> > >
> > > Deprecated by whom?
> >
> > http://mirrors.bieringer.de/Linux+IPv6-HOWTO/conf-ipv6-in-ipv4-point-to-p
> >oint-tunnels.html (Section headings 9.3.1.1 & 9.3.1.2)
> > http://seclists.org/lists/honeypots/2004/Jan-Mar/0209.html
> > http://www.uwsg.iu.edu/hypermail/linux/kernel/0108.2/0485.html
>
> These are deprecating the use of "ifconfig", not the use of
> pseudo-interface names.

That is precisely what I was saying is deprecated - the use of ifconfig.

One of the results of using it is that you automatically and non-optionally 
get the pseudo-interface names (which are optional if you use ip addr).

Sorry if my wording was unclear - I didn't mean to suggest that multiple names 
for interfaces are inherently a bad idea or deprecated.

> However, most people aren't dealing with ipv6-in-ipv4 tunnels,
> honeypots, or thousands of IPs per interface, as are the references
> you cite.  "ifconfig" will handle the vast majority of cases and is
> simpler to use when the power of "ip" is not needed.

I simply looked up references to support my assertion that "ifconfig eth0:0" 
etc is deprecated.   The particular reasons why these people are using 
multiple IPs on one interface are irrelevant.

I agree with you that ifconfig will handle the majority of cases.

I don't agree that it's simpler to use, but I think that's just a matter of 
opinion.

However, as I said in my earlier posting, it doesn't matter to netfilter which 
method you use to get the multiple IPs, so by all means choose whichever you 
prefer.   I don't regard it as a big deal - I was simply surprised that you 
hadn't come across this use of ifconfig as being deprecated, so I gave some 
examples.

Regards,

Antony.

-- 
This email was created using 100% recycled electrons.

                                                     Please reply to the list;
                                                           please don't CC me.