From: Igor Bogomazov <bi@hl.ru>
To: netfilter@vger.kernel.org
Subject: Fw: INVALID connections and SNAT
Date: Tue, 13 Apr 2010 11:36:19 +0400 [thread overview]
Message-ID: <20100413113619.65adedf0@admin.hl.ru> (raw)
[-- Attachment #1: Type: text/plain, Size: 2182 bytes --]
> Which are your rules in the nat table (POSTROUTING)?
Briefly, what I have:
*nat
-A POSTROUTING -s 192.168.1.0/24 ! -d 192.168.0.0/16 \
-j SNAT --to-source 22.33.44.55
*filter
-A FORWARD -s 192.168.0.0/24 \
-m comment --comment "admin-subnet" -j ACCEPT
-A FORWARD -d 192.168.1.0/24 \
-m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 192.168.1.0/24 \
-j REJECT --reject-with icmp-host-unreachable
-A FORWARD -s 192.168.1.0/24 \
-j ACCEPT
how to test:
tcpdump -i eth0 -ne 'net 192.168.1.0/24'
here eth0 (22.33.44.55): internet interface
as example, what test outputs _sometimes_ (rarely):
IP 192.168.1.4.50226 > 74.125.77.19.443: F 253979169:253979169(0) ack
3081852170 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0)
ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1
win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win
16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: R 1:1(0) ack 1 win 0
Also:
1. flushing connections with 'conntrack -F' considerably increases the
rate of these unNATed packets
2. after
iptables -A FORWARD -s 192.168.0.0/16 \! -d 192.168.0.0/16 \
-m state --state INVALID -j DROP
all works properly (no strange packets)
>
> Jorge Dávila.
>
> Jorge Isaac Davila Lopez
> Nicaragua Open Source
> +505-8430-5462
> davila@nicaraguaopensource.com
>
> En Abr 12, 2010, Igor Bogomazov <bi@hl.ru> escribió:
> Hello,
>
> Just noticed few packets which pass SNAT in POSTROUTING without
> altering their SRC. The problem has been obscured by the fact, that
> all works in general, no one complain.
>
> After I add REJECT rule for "-m state --state INVALID" connections,
> unmodified (not NATed) packets have disappeared. All right now.
>
> Why INVALID connections pass thru NAT instead of dropping them? It
> seems like a security risk, when hacker can listen not-NATed packets
> behind the router and learn a network topology.
>
--
С уважением,
Igor Bogomazov
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]
reply other threads:[~2010-04-13 7:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100413113619.65adedf0@admin.hl.ru \
--to=bi@hl.ru \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).