using iptables with tun/tap interfaces? no rule sees tun/tap interface traffic

using iptables with tun/tap interfaces? no rule sees tun/tap interface traffic

[Tomasz Chmielewski]

I'm trying to filter traffic on a tap interface.

The traffic is coming from a qemu/kvm guest and can be captured i.e. with tcpdump:

# tcpdump -i tap0 -v -n
tcpdump: WARNING: tap0: no IPv4 address assigned
tcpdump: listening on tap0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:51:15.695350 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.10.145 > 192.168.10.81: ICMP echo request, id 3864, seq 1, length 64
12:51:15.895316 IP (tos 0x0, ttl 64, id 46926, offset 0, flags [none], proto ICMP (1), length 84)
    192.168.10.81 > 192.168.10.145: ICMP echo reply, id 3864, seq 1, length 64


Now, let's see if iptables can capture this kind of traffic - let's add some ACCEPT rules for the tap0 interface:

iptables -I OUTPUT -o tap0 -j ACCEPT
iptables -I INPUT -o tap0 -j ACCEPT
iptables -I FORWARD -o tap0 -j ACCEPT
iptables -I FORWARD -i tap0 -j ACCEPT
iptables -t nat -I PREROUTING -i tap0 -j ACCEPT
iptables -t nat -I POSTROUTING -o tap0 -j ACCEPT
iptables -t nat -I OUTPUT -o tap0 -j ACCEPT


Let's push some traffic and see if iptables statistics caught any packets:


# iptables -L -t nat -v -n
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  tap0   *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 57 packets, 4260 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      tap0    0.0.0.0/0            0.0.0.0/0

Chain POSTROUTING (policy ACCEPT 52 packets, 3255 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      tap0    0.0.0.0/0            0.0.0.0/0



# iptables -L  -v -n
Chain INPUT (policy ACCEPT 11125 packets, 5245K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  tap0   *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  tap0   *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      tap0    0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 10105 packets, 12M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      tap0    0.0.0.0/0            0.0.0.0/0



As we can see, no traffic (pkts/bytes) in the rules having this tap0 interface:

tap0      Link encap:Ethernet  HWaddr EE:36:E1:A2:DA:36  
          inet6 addr: fe80::ec36:e1ff:fea2:da36/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:4019 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4084 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500 
          RX bytes:363208 (354.6 KiB)  TX bytes:412993 (403.3 KiB)


Did I make some obvious mistake?

How can I use iptables to filter traffic on tap interfaces?


-- 
Tomasz Chmielewski
http://wpkg.org

Re: using iptables with tun/tap interfaces? no rule sees tun/tap interface traffic

[Marek Kierdelewicz]

Hi Tomasz,

>tcpdump: WARNING: tap0: no IPv4 address assigned

So you're bridging.

Make sure /proc/sys/net/bridge/bridge-nf-call-iptables is set to 1.

Good luck.

Best regards,
Marek

Re: using iptables with tun/tap interfaces? no rule sees tun/tap interface traffic

[Tomasz Chmielewski]

On 29.08.2010 13:15, Marek Kierdelewicz wrote:
> Hi Tomasz,
>
>> tcpdump: WARNING: tap0: no IPv4 address assigned
>
> So you're bridging.
>
> Make sure /proc/sys/net/bridge/bridge-nf-call-iptables is set to 1.

# cat /proc/sys/net/bridge/bridge-nf-call-iptables
1

Using 2.6.35 kernel.

Should I use ebtables for this? iptables seem more flexible here.



-- 
Tomasz Chmielewski
http://wpkg.org

Re: using iptables with tun/tap interfaces? no rule sees tun/tap interface traffic

[Marek Kierdelewicz]

Hi,

>Using 2.6.35 kernel.
>Should I use ebtables for this? iptables seem more flexible here.

Iptables should work great. Try matching interface with
physdev-in/physdev-out instead of -i/-o as described here:
http://bwachter.lart.info/linux/bridges.html

If it doesn't help try using ip address matching rules to narrow down
the problem and see if you get any hits.

I hope you're using kernel bridge for bridging. I don't think you'll be
able to filter traffic bridged with userspace tools like vde.

Best regards,
Marek

Re: using iptables with tun/tap interfaces? no rule sees tun/tap interface traffic

[Tomasz Chmielewski]

On 29.08.2010 14:21, Marek Kierdelewicz wrote:
> Hi,
>
>> Using 2.6.35 kernel.
>> Should I use ebtables for this? iptables seem more flexible here.
>
> Iptables should work great. Try matching interface with
> physdev-in/physdev-out instead of -i/-o as described here:
> http://bwachter.lart.info/linux/bridges.html

It did the trick, thanks!


-- 
Tomasz Chmielewski
http://wpkg.org

Re: using iptables with tun/tap interfaces? no rule sees tun/tap interface traffic

[Pascal Hambourg]

Hello,

Marek Kierdelewicz a écrit :
> 
>> tcpdump: WARNING: tap0: no IPv4 address assigned
> 
> So you're bridging.
> 
> Make sure /proc/sys/net/bridge/bridge-nf-call-iptables is set to 1.

It is by default.
But -i/-o must match the bridge interface, not the port. Ports can be
matched with the physdev match as you pointed out in another post.

Tomasz asked :
>
> Should I use ebtables for this?

Yes, if ebtables can do what you need.