Fw: INVALID connections and SNAT

Fw: INVALID connections and SNAT

[Igor Bogomazov]

[-- Attachment #1: Type: text/plain, Size: 2182 bytes --]

> Which are your rules in the nat table (POSTROUTING)?

Briefly, what I have:

*nat
-A POSTROUTING -s 192.168.1.0/24 ! -d 192.168.0.0/16 \
	-j SNAT --to-source 22.33.44.55
*filter
-A FORWARD -s 192.168.0.0/24 \
	-m comment --comment "admin-subnet" -j ACCEPT
-A FORWARD -d 192.168.1.0/24 \
	-m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 192.168.1.0/24 \
	-j REJECT --reject-with icmp-host-unreachable
-A FORWARD -s 192.168.1.0/24 \
	-j ACCEPT

how to test:

tcpdump -i eth0 -ne 'net 192.168.1.0/24'

here eth0 (22.33.44.55): internet interface

as example, what test outputs _sometimes_ (rarely):

IP 192.168.1.4.50226 > 74.125.77.19.443: F 253979169:253979169(0) ack
	3081852170 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0)
	ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1
	win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win
	16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: F 0:0(0) ack 1 win 16445
IP 192.168.1.4.50226 > 74.125.77.19.443: R 1:1(0) ack 1 win 0 

Also:

1. flushing connections with 'conntrack -F' considerably increases the
	rate of these unNATed packets
2. after
	iptables -A FORWARD -s 192.168.0.0/16 \! -d 192.168.0.0/16 \
	-m state --state INVALID -j DROP
   all works properly (no strange packets)

> 
> Jorge Dávila.
> 
> Jorge Isaac Davila Lopez
> Nicaragua Open Source
> +505-8430-5462
> davila@nicaraguaopensource.com
> 
> En Abr 12, 2010, Igor Bogomazov <bi@hl.ru> escribió:
> Hello,
> 
> Just noticed few packets which pass SNAT in POSTROUTING without
> altering their SRC. The problem has been obscured by the fact, that
> all works in general, no one complain.
> 
> After I add REJECT rule for "-m state --state INVALID" connections,
> unmodified (not NATed) packets have disappeared. All right now.
> 
> Why INVALID connections pass thru NAT instead of dropping them? It
> seems like a security risk, when hacker can listen not-NATed packets
> behind the router and learn a network topology.
> 

--
С уважением,

Igor Bogomazov

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]