Re: blocking traffic between two internal interfaces ?

Re: blocking traffic between two internal interfaces ?

[/dev/rob0]

On Wednesday 2005-October-19 23:11, Seferovic Edvin wrote:
> I would use interfaces, not IP addresses.
>
> 	You mean - physdev matching?

I mean -i and -o options.

> Iptables -A FORWARD -d 172.20.0.0/16 -m physdev --physdev-in eth1
> -j DROP
>
> This rule works now.. I must had an ESTABLISHED connection in my
> conntrack table since this rule didn't work first time I tried it.

That makes sense. See, you can't evaluate why something doesn't work as 
expected unless you know the whole picture.

> Now Ive restarted my gateway

You can also flush all iptables rules, unload all netfilter modules, 
then reload and restore. You'll start with an empty conntrack table. 
(Someone will mention the new conntrack tool which will work with 
2.6.14 and later.)

> and applied this rule and now I cannot access the 172.20.0.0 net.
>
> Any suggestions?

Was this not the goal? What is to suggest?
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

RE: blocking traffic between two internal interfaces ?

[Seferovic Edvin]

On Wednesday 2005-October-19 23:11, Seferovic Edvin wrote:
> I would use interfaces, not IP addresses.
>
> 	You mean - physdev matching?

>I mean -i and -o options.

	Packet do come in on the eth1 but I dont think that they will leave
eth2 because ( for example only ) - what happens when I try to access
services on IP of eth2? Is another routing decision made or are they just
kept in eth2? 

> Iptables -A FORWARD -d 172.20.0.0/16 -m physdev --physdev-in eth1
> -j DROP
>
> This rule works now.. I must had an ESTABLISHED connection in my
> conntrack table since this rule didn't work first time I tried it.

>That makes sense. See, you can't evaluate why something doesn't work as 
>expected unless you know the whole picture.

	I try to keep the whole pic in my head, but when you work the whole
night long - that is not so easy ;)

> Now Ive restarted my gateway

>You can also flush all iptables rules, unload all netfilter modules, 
>then reload and restore. You'll start with an empty conntrack table. 
>(Someone will mention the new conntrack tool which will work with 
>2.6.14 and later.)

	Yes ... It was me who asked about the possibility to clear the
conntrack table because I couldn't unload the iptable-modules. They are
"being used" :( . So I think Ill have to wait until 2.6.14....

> and applied this rule and now I cannot access the 172.20.0.0 net.
>
> Any suggestions?

>Was this not the goal? What is to suggest?

	Maybe some other more elegant solution ;) Not every solutions is the
best one. But sure - goal reached ;) Thank You very much !

Regards,

Edvin Seferovic

Re: blocking traffic between two internal interfaces ?

[/dev/rob0]

On Thursday 2005-October-20 00:22, Seferovic Edvin wrote:
> > I would use interfaces, not IP addresses.
> >
> > 	You mean - physdev matching?
> >
> >I mean -i and -o options.
>
> Packet do come in on the eth1 but I dont think that they will leave
> eth2 because ( for example only ) - what happens when I try to access
> services on IP of eth2?

We were talking about FORWARD. Sounds like you are talking about INPUT. 
Yes, users on the eth1 segment will be able to access services on the 
firewall machine using its eth2 (or any other) IP address, unless you 
block with rules in INPUT or OUTPUT.

> Is another routing decision made or are they just kept in eth2?

They're not routed. It's a local destination. So no, there is no output 
interface.

> >That makes sense. See, you can't evaluate why something doesn't work
> > as expected unless you know the whole picture.
>
> I try to keep the whole pic in my head, but when you work the whole
> night long - that is not so easy ;)

I was just trying to make you feel guilty for withholding information 
from your post. :) But indeed, it's not always easy to get the picture 
in your head, and working nights can't help. :)

> > and applied this rule and now I cannot access the 172.20.0.0 net.
> >
> > Any suggestions?
> >
> >Was this not the goal? What is to suggest?
>
> Maybe some other more elegant solution ;) Not every solutions is the
> best one. But sure - goal reached ;) Thank You very much !

Hmmm, 2 rules (4 if you want to REJECT the -p tcp) and total separation 
of the segments ... sounds good to me. But I'm not you. If there's 
something missing, let us know. You can always precede your DROP/REJECT 
rules with exceptions if necessary.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: blocking traffic between two internal interfaces ?

[/dev/rob0]

On Wednesday 2005-October-19 22:07, Seferovic Edvin wrote:
> I have two internal interfaces ( eth1 // 172.19.0.0 & eth2 //
> 172.20.0.0 ), and I would like to block traffic between those two
> networks. Somehow Ive failed because any rules that should forbid
> traffic between those 2 networks didn't work. I still could access
> webserver on the eth2 - 172.20.10.1 from a station with IP address
> 172.19.1.100 ! Then Ive applied rule in PREROUTING chain in nat

Thou shalt not filter in the nat table.

> Iptables -t nat -A PREROUTING -s 172.19.0.0/16 -d 172.20.0.0/16 -j
> DROP

I would use interfaces, not IP addresses.

> Rules in FORWARD and INPUT chain just wouldn't work. Is this the

What did you try in FORWARD?

> right way to forbid traffic from one network to the another or am I
> missing some basic stuff here? I would appreciate any comments.

In FORWARD, block incoming on eth1 going to eth2 and vice versa.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

RE: blocking traffic between two internal interfaces ?

[Seferovic Edvin]

On Wednesday 2005-October-19 22:07, Seferovic Edvin wrote:
> I have two internal interfaces ( eth1 // 172.19.0.0 & eth2 //
> 172.20.0.0 ), and I would like to block traffic between those two
> networks. Somehow Ive failed because any rules that should forbid
> traffic between those 2 networks didn't work. I still could access
> webserver on the eth2 - 172.20.10.1 from a station with IP address
> 172.19.1.100 ! Then Ive applied rule in PREROUTING chain in nat

Thou shalt not filter in the nat table.

	I knew this one ;)

> Iptables -t nat -A PREROUTING -s 172.19.0.0/16 -d 172.20.0.0/16 -j
> DROP

I would use interfaces, not IP addresses.

	You mean - physdev matching?

> Rules in FORWARD and INPUT chain just wouldn't work. Is this the

What did you try in FORWARD?

	Iptables -A FORWARD -d 172.20.0.0/16 -m physdev --physdev-in eth1 -j
DROP

This rule works now.. I must had an ESTABLISHED connection in my conntrack
table since this rule didn't work first time I tried it. Now Ive restarted
my gateway and applied this rule and now I cannot access the 172.20.0.0 net.


Any suggestions?

Thank you in advance.

Regards,

Edvin Seferovic

blocking traffic between two internal interfaces ?

[Seferovic Edvin]

Hi,

 

I have two internal interfaces ( eth1 // 172.19.0.0 & eth2 // 172.20.0.0 ),
and I would like to block traffic between those two networks. Somehow Ive
failed because any rules that should forbid traffic between those 2 networks
didn't work. I still could access webserver on the eth2 - 172.20.10.1 from a
station with IP address 172.19.1.100 ! Then Ive applied rule in PREROUTING
chain in nat table:



Iptables -t nat -A PREROUTING -s 172.19.0.0/16 -d 172.20.0.0/16 -j DROP

 

Rules in FORWARD and INPUT chain just wouldn't work. Is this the right way
to forbid traffic from one network to the another or am I missing some basic
stuff here? I would appreciate any comments.

 

Thank you in advance !

 

Regards,

 

Edvin Seferovic