Change of ip addresses continues.... :(

Change of ip addresses continues.... :(

[dravya]

Hi people/Daniel,

I have been trying various set of rules in various table in order to have packets go over
the right link. ie. packet's src add should match outgoing link's ip address. YET, there
are some packets that always tend to go over the wrong link and thus causing ip address
change. They mostly seem to be ICMP Destination Unreacheable messages or DNS queries.

I tried out the rules that Daniel Chemko so generously had provided me with...and they
don't seem to work. I am probably not doing something right. I just tried the following
rules with no luck:

iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
iptables -t mangle -A PREROUTING -m mark ! --mark 0 -p icmp -j MARK --set-mark 1
iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -j CONNMARK --save-mark
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
ptables -t nat -A POSTROUTING -o ppp1 -j MASQUERADE

Are these rules supposed to create 2 routing tables???? If they do, I don't seem them? 
This is what I see:

[ ]# ip rule list
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup 253

I even tried the ROUTE rule separately with no luck (still ip changes):

iptables -A POSTROUTING -t mangle -p icmp -j ROUTE --oif ppp0

Not to mention I initially tried MASQUERADING and that is when Daniel told me that there
were a few problems with Masquerading. 

I am to the point of pulling my hair.... thus... any help whatsoever would be appreciated.
Thanks guys,

Dravya

RE: Change of ip addresses continues.... :(

[Jason Opperisano]

> I have been trying various set of rules in various table in order to have packets go over
> the right link. ie. packet's src add should match outgoing link's ip address.YET, there
> are some packets that always tend to go over the wrong link and thus causing ip address
> change. They mostly seem to be ICMP Destination Unreacheable messages or DNS queries.

please verify that the ICMP dest-unreach & DNS queries are not locally generated packets from the firewall machine itself.  everything you're doing thus far applies to packets being routed through the firewall; not from the firewall--that's a whole different story...

> I tried out the rules that Daniel Chemko so generously had provided me with...and they
> don't seem to work. I am probably not doing something right. I just tried thefollowing
> rules with no luck:
>
> iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
> iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
> iptables -t mangle -A PREROUTING -m mark ! --mark 0 -p icmp -j MARK --set-mark 1
> iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j MARK --set-mark 2
> iptables -t mangle -A PREROUTING -j CONNMARK --save-mark
> iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
> ptables -t nat -A POSTROUTING -o ppp1 -j MASQUERADE
>
> Are these rules supposed to create 2 routing tables???? If they do, I don't seem them?
> This is what I see:
>
> [ ]# ip rule list
> 0:      from all lookup local
> 32766:  from all lookup main
> 32767:  from all lookup 253

no--iptables commands do not create extra routing tables--you have to do this yourself.  hopefully, you've been studying up on http://lartc.org/howto/index.html (specifically http://lartc.org/howto/lartc.netfilter.html)

something like:

  echo 500 icmp >> /etc/iproute2/rt_tables
  ip rule add fwmark 1 table icmp
  ip route add default via $ICMP_LINK dev $ICMP_LINK_IF table icmp

will make the packets marked with "--set-mark 1" (icmp packets in your example), get their default gateway from the alternate routing table named "icmp"

again--this applies to packets being routed through the gateway, not to packets coming from the gateway.

-j

RE: Change of ip addresses continues.... :(

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 717 bytes --]

On Thu, 2004-08-26 at 23:26, Jason Opperisano wrote:
> > I have been trying various set of rules in various table in order to have packets go over
> > the right link. ie. packet's src add should match outgoing link's ip address.YET, there
> > iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
> > iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
> > iptables -t mangle -A PREROUTING -m mark ! --mark 0 -p icmp -j MARK --set-mark 1
> > iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j MARK --set-mark 2

There's something weird here : 
-m mark ! --mark 0 
at each line you should better do 
-m mark --mark 0
at the two last lines.

BR,
-- 
Eric Leblond <eric@inl.fr>
INL

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

RE: Change of ip addresses continues.... :(

[Jason Opperisano]

>   echo 500 icmp >> /etc/iproute2/rt_tables
>   ip rule add fwmark 1 table icmp
>   ip route add default via $ICMP_LINK dev $ICMP_LINK_IF table icmp

crap...  that's not very clear--it should be:

  ip route add default via $ICMP_LINK_GW dev $ICMP_LINK_IF table icmp

for example:

  ip route add default via 1.2.3.4 dev ppp0 table icmp

sorry.

-j

RE: Change of ip addresses continues.... :(

[Daniel Chemko]

First, you must understand that PREROUTING will only handle policy
routing FORWARDED traffic, and will not properly deal with traffic from
the firewall itself. Please make sure to duplicate the rules with:
"iptables -t mangle -A OUTPUT". That means, if the firewall gets an
invalid TCP connection attempt, it will send the ICMP reply out the
correct interface. 

Ok, to make your routes, here's a pre-canned function:

You'll have to fix up the following function to create the default route
the way that ppp assigns them. What I'd do is add this to ppp's ip-up
script so that as soon as you know your new ppp address, you change the
table to reflect the new value. 


Here 'might' be a way to do it. I don't have ppp lines so I couldn't say
if its right or not.

_mark="$((`echo "${1}" | sed s/ppp//`+1))"
_ext_gw="${5}";
_local_ip="${4}";

route_builder "${_mark}" "${_ext_gw}" "${_local_ip}"


The following IS what I use to build routes. I'm pretty sure it'll work
as advertised.
#
# Notes:
#    This function generates a new routing table based on the currect
main
#    routing table. The difference is that the default route is user
specified.
# 
# Arguments:
#    1 - Table ID to create
#    2 - IP Address, Gateway Address 
#    3 - IP Address, Local Source
#
IP=ip
function route_builder
{
   _table_id=${1}
   _table_gateway=${2}
   _table_source=${3}
   if [ "${1}" != "" -a "${2}" != "" ]; then
      ${IP} rule del fwmark ${_table_id} table ${_table_id}
      ${IP} rule add fwmark ${_table_id} table ${_table_id}
      ${IP} route flush table ${_table_id}
      ${IP} route show table main | grep -Ev ^default
\
      | while read ROUTE ; do   
         ${IP} route add table ${_table_id} $ROUTE
      done
      ${IP} route add table ${_table_id} default via ${_table_gateway}
\
         src ${_table_source}
   else
      echo "route_builder: Invalid arguments specified."
   fi
}

RE: Change of ip addresses continues.... :(

[Daniel Chemko]

Eric Leblond wrote:
> On Thu, 2004-08-26 at 23:26, Jason Opperisano wrote:
>>> I have been trying various set of rules in various table in order
>>> to have packets go over the right link. ie. packet's src add should
>>> match outgoing link's ip address.YET, there iptables -t mangle -A
>>> PREROUTING -j CONNMARK --restore-mark 
>>> iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
>>> iptables -t mangle -A PREROUTING -m mark ! --mark 0 -p icmp -j MARK
>>> --set-mark 1 iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j
>>> MARK --set-mark 2 
> 
> There's something weird here :
> -m mark ! --mark 0
> at each line you should better do
> -m mark --mark 0
> at the two last lines.
> 
> BR,

Just to confirm, Eric is correct, you should be using -m mark --mark 0
for the last two rules. In conclusion, for the most simple of setups for
this, we'd have the following:

	iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
# Skip through any pre-classifed traffic
	iptables -t mangle -A PREROUTING -m mark ! --mark 0 -j ACCEPT
# Define inbound policies
	iptables -t mangle -A PREROUTING -m mark --mark 0 -m state
--state NEW -i ppp0 -j MARK --set-mark 1
	iptables -t mangle -A PREROUTING -m mark --mark 0 -m state
--state NEW -i ppp1 -j MARK --set-mark 2
# Default policy route for any internal traffic
	iptables -t mangle -A PREROUTING -m mark --mark 0 -j MARK
--set-mark 2
	iptables -t mangle -A PREROUTING -j CONNMARK --save-mark

	iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
	iptables -t mangle -A OUTPUT -m mark ! --mark 0 -j ACCEPT
# Make sure any packets that have existing IP's before this networking
level to keep their existing IP's
	iptables -t mangle -A OUTPUT -m mark --mark 0 --source
${ppp0_ip} -j MARK --set-mark 1
	iptables -t mangle -A OUTPUT -m mark --mark 0 --source
${ppp1_ip} -j MARK --set-mark 2
# Default policy route for this firewall
	iptables -t mangle -A OUTPUT -m mark --mark 0 -j MARK --set-mark
2
	iptables -t mangle -A OUTPUT -j CONNMARK --save-mark

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o ppp1 -j MASQUERADE