* DNAT hiding routers behind it
@ 2004-08-06 17:25 Simon Lodal
2004-08-06 18:26 ` Dick St.Peters
0 siblings, 1 reply; 8+ messages in thread
From: Simon Lodal @ 2004-08-06 17:25 UTC (permalink / raw)
To: netfilter
I am traceroute'ing a DNAT'ed host. Surprisingly, all routers between
the DNAT'ing firewall and the host appear as the IP address I am
traceroute'ing. Is this intended? Can it be controlled in some way? (it
is not necessarily bad)
Example:
traceroute to 217.116.235.62 (217.116.235.62), 30 hops max, 38 byte packets
1 192.168.0.2 (192.168.0.2) 4.152 ms 0.875 ms 0.865 ms
2 217.116.235.62 (217.116.235.62) 1.928 ms 1.272 ms 1.430 ms
3 217.116.235.62 (217.116.235.62) 2.013 ms 2.338 ms 2.330 ms
Line 1: DNAT'ing firewall.
Line 2: A router.
Line 3: DNAT'ed host.
I would the expect the router to show up with it's own IP address, not
the original target address.
Simon
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: DNAT hiding routers behind it
2004-08-06 17:25 DNAT hiding routers behind it Simon Lodal
@ 2004-08-06 18:26 ` Dick St.Peters
2004-08-06 21:08 ` Simon Lodal
0 siblings, 1 reply; 8+ messages in thread
From: Dick St.Peters @ 2004-08-06 18:26 UTC (permalink / raw)
To: Simon Lodal; +Cc: netfilter
Simon Lodal writes:
> I am traceroute'ing a DNAT'ed host. Surprisingly, all routers between
> the DNAT'ing firewall and the host appear as the IP address I am
> traceroute'ing. Is this intended? Can it be controlled in some way? (it
> is not necessarily bad)
>
> Example:
> traceroute to 217.116.235.62 (217.116.235.62), 30 hops max, 38 byte packets
> 1 192.168.0.2 (192.168.0.2) 4.152 ms 0.875 ms 0.865 ms
> 2 217.116.235.62 (217.116.235.62) 1.928 ms 1.272 ms 1.430 ms
> 3 217.116.235.62 (217.116.235.62) 2.013 ms 2.338 ms 2.330 ms
>
> Line 1: DNAT'ing firewall.
> Line 2: A router.
> Line 3: DNAT'ed host.
Is the router a small Linksys router? They do this without being
behind a firewall or NAT box.
--
Dick St.Peters, stpeters@NetHeaven.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: DNAT hiding routers behind it
2004-08-06 18:26 ` Dick St.Peters
@ 2004-08-06 21:08 ` Simon Lodal
2004-08-06 22:56 ` Antony Stone
0 siblings, 1 reply; 8+ messages in thread
From: Simon Lodal @ 2004-08-06 21:08 UTC (permalink / raw)
To: netfilter; +Cc: Dick St.Peters
No Linksys here, the firewall is a linux PC, the "router" is an Extreme
Networks Summit 200 switch that acts like a router.
I do not think it matters. Point is that the router sends an icmp
ttl-exceeded, which the firewall apparently considers part of the
connection, and therefore does reverse DNAT on.
My problem is why it does that, and if it can be avoided.
Simon
Dick St.Peters skrev:
> Simon Lodal writes:
>
>>I am traceroute'ing a DNAT'ed host. Surprisingly, all routers between
>>the DNAT'ing firewall and the host appear as the IP address I am
>>traceroute'ing. Is this intended? Can it be controlled in some way? (it
>>is not necessarily bad)
>>
>>Example:
>>traceroute to 217.116.235.62 (217.116.235.62), 30 hops max, 38 byte packets
>> 1 192.168.0.2 (192.168.0.2) 4.152 ms 0.875 ms 0.865 ms
>> 2 217.116.235.62 (217.116.235.62) 1.928 ms 1.272 ms 1.430 ms
>> 3 217.116.235.62 (217.116.235.62) 2.013 ms 2.338 ms 2.330 ms
>>
>>Line 1: DNAT'ing firewall.
>>Line 2: A router.
>>Line 3: DNAT'ed host.
>
>
> Is the router a small Linksys router? They do this without being
> behind a firewall or NAT box.
>
> --
> Dick St.Peters, stpeters@NetHeaven.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: DNAT hiding routers behind it
2004-08-06 21:08 ` Simon Lodal
@ 2004-08-06 22:56 ` Antony Stone
2004-08-07 2:51 ` Simon Lodal
0 siblings, 1 reply; 8+ messages in thread
From: Antony Stone @ 2004-08-06 22:56 UTC (permalink / raw)
To: netfilter
On Friday 06 August 2004 10:08 pm, Simon Lodal wrote:
> No Linksys here, the firewall is a linux PC, the "router" is an Extreme
> Networks Summit 200 switch that acts like a router.
>
> I do not think it matters. Point is that the router sends an icmp
> ttl-exceeded, which the firewall apparently considers part of the
> connection, and therefore does reverse DNAT on.
>
> My problem is why it does that, and if it can be avoided.
My guess is that you have a MASQUERADE rule with no interface specified - so
packets get the source address of the firewall whether they're going out or
coming in?
Make sure you specify "-o eth0" or "-o ppp0" or whatever your external
interface is called.
If not that, post your ruleset so we can have a further think...
Regards,
Antony.
> Dick St.Peters skrev:
> > Simon Lodal writes:
> >>I am traceroute'ing a DNAT'ed host. Surprisingly, all routers between
> >>the DNAT'ing firewall and the host appear as the IP address I am
> >>traceroute'ing. Is this intended? Can it be controlled in some way? (it
> >>is not necessarily bad)
> >>
> >>Example:
> >>traceroute to 217.116.235.62 (217.116.235.62), 30 hops max, 38 byte
> >> packets 1 192.168.0.2 (192.168.0.2) 4.152 ms 0.875 ms 0.865 ms
> >> 2 217.116.235.62 (217.116.235.62) 1.928 ms 1.272 ms 1.430 ms
> >> 3 217.116.235.62 (217.116.235.62) 2.013 ms 2.338 ms 2.330 ms
> >>
> >>Line 1: DNAT'ing firewall.
> >>Line 2: A router.
> >>Line 3: DNAT'ed host.
> >
> > Is the router a small Linksys router? They do this without being
> > behind a firewall or NAT box.
> >
> > --
> > Dick St.Peters, stpeters@NetHeaven.com
--
The difference between theory and practice is that in theory there is no
difference, whereas in practice there is.
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: DNAT hiding routers behind it
2004-08-06 22:56 ` Antony Stone
@ 2004-08-07 2:51 ` Simon Lodal
2004-08-07 7:37 ` Antony Stone
0 siblings, 1 reply; 8+ messages in thread
From: Simon Lodal @ 2004-08-07 2:51 UTC (permalink / raw)
To: netfilter
> My guess is that you have a MASQUERADE rule with no interface specified - so
> packets get the source address of the firewall whether they're going out or
> coming in?
>
> Make sure you specify "-o eth0" or "-o ppp0" or whatever your external
> interface is called.
>
> If not that, post your ruleset so we can have a further think...
Testcase, as simple as possible:
pc has 10.44.252.2
fw has 10.44.252.1 on inside (vmnet2), 10.44.8.10 on outside (eth0).
On outside of fw there is a chain of routers; 10.44.8.1 => 192.168.44.1,
which is again connected to both 192.168.1.11 and 192.168.2.11 which
I'll use below.
masquerading or snat (tried both, no difference):
root@fw # iptables -t nat -A POSTROUTING -o eth0 -s 10.44.252.2 -j SNAT
--to-source 10.44.8.10
No other iptables rules are defined yet.
simonl@pc $ traceroute -q1 -I 192.168.1.11
traceroute to 192.168.1.11 (192.168.1.11), 30 hops max, 38 byte packets
1 10.44.252.1 (10.44.252.1) 4.297 ms
2 10.44.8.1 (10.44.8.1) 3.892 ms
3 192.168.44.1 (192.168.44.1) 4.826 ms
4 192.168.1.11 (192.168.1.11) 5.095 ms
All good. Now for the fun (dnat to another host at similar distance):
root@fw # iptables -t nat -A PREROUTING -i vmnet2 -s 10.44.252.2 -d
192.168.1.11 -j DNAT --to-destination 192.168.2.11
simonl@pc $ traceroute -q1 -I 192.168.1.11
traceroute to 192.168.1.11 (192.168.1.11), 30 hops max, 38 byte packets
1 10.44.252.1 (10.44.252.1) 1.854 ms
2 192.168.1.11 (192.168.1.11) 9.378 ms
3 192.168.1.11 (192.168.1.11) 17.237 ms
4 192.168.1.11 (192.168.1.11) 3.783 ms
See?
I tried dnat'ing without snat on a real network, same problem.
So snat/masquerade has no influence (it is just needed for my setup).
Simon
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: DNAT hiding routers behind it
2004-08-07 2:51 ` Simon Lodal
@ 2004-08-07 7:37 ` Antony Stone
2004-08-07 14:47 ` Simon Lodal
0 siblings, 1 reply; 8+ messages in thread
From: Antony Stone @ 2004-08-07 7:37 UTC (permalink / raw)
To: netfilter
On Saturday 07 August 2004 3:51 am, Simon Lodal wrote:
> > My guess is that you have a MASQUERADE rule with no interface specified -
> > so packets get the source address of the firewall whether they're going
> > out or coming in?
>
> masquerading or snat (tried both, no difference):
> root@fw # iptables -t nat -A POSTROUTING -o eth0 -s 10.44.252.2 -j SNAT
> --to-source 10.44.8.10
>
> No other iptables rules are defined yet.
>
> simonl@pc $ traceroute -q1 -I 192.168.1.11
> traceroute to 192.168.1.11 (192.168.1.11), 30 hops max, 38 byte packets
> 1 10.44.252.1 (10.44.252.1) 4.297 ms
> 2 10.44.8.1 (10.44.8.1) 3.892 ms
> 3 192.168.44.1 (192.168.44.1) 4.826 ms
> 4 192.168.1.11 (192.168.1.11) 5.095 ms
>
> All good. Now for the fun (dnat to another host at similar distance):
> root@fw # iptables -t nat -A PREROUTING -i vmnet2 -s 10.44.252.2 -d
> 192.168.1.11 -j DNAT --to-destination 192.168.2.11
>
> simonl@pc $ traceroute -q1 -I 192.168.1.11
> traceroute to 192.168.1.11 (192.168.1.11), 30 hops max, 38 byte packets
> 1 10.44.252.1 (10.44.252.1) 1.854 ms
> 2 192.168.1.11 (192.168.1.11) 9.378 ms
> 3 192.168.1.11 (192.168.1.11) 17.237 ms
> 4 192.168.1.11 (192.168.1.11) 3.783 ms
>
> See?
Yes. Strange. I think I'd like to see the output of "traceroute -q1 -I
192.168.2.11" (with or without the DNAT rule, shouldn't make any difference).
Also, can you put a packet sniffer such as ethereal on the link 10.44.8.10 -
10.44.8.1 to see what packets are really leaving your firewall to the rest of
the network?
Regards,
Antony.
--
"Reports that say that something hasn't happened are always interesting to me,
because as we know, there are known knowns; there are things we know we know.
We also know there are known unknowns; that is to say we know there are some
things we do not know. But there are also unknown unknowns - the ones we
don't know we don't know."
- Donald Rumsfeld, US Secretary of Defence
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: DNAT hiding routers behind it
2004-08-07 7:37 ` Antony Stone
@ 2004-08-07 14:47 ` Simon Lodal
2004-08-11 20:29 ` Aleksandar Milivojevic
0 siblings, 1 reply; 8+ messages in thread
From: Simon Lodal @ 2004-08-07 14:47 UTC (permalink / raw)
To: netfilter
[-- Attachment #1: Type: text/plain, Size: 3437 bytes --]
>>simonl@pc $ traceroute -q1 -I 192.168.1.11
>>traceroute to 192.168.1.11 (192.168.1.11), 30 hops max, 38 byte packets
>> 1 10.44.252.1 (10.44.252.1) 4.297 ms
>> 2 10.44.8.1 (10.44.8.1) 3.892 ms
>> 3 192.168.44.1 (192.168.44.1) 4.826 ms
>> 4 192.168.1.11 (192.168.1.11) 5.095 ms
>>
>>All good. Now for the fun (dnat to another host at similar distance):
>>root@fw # iptables -t nat -A PREROUTING -i vmnet2 -s 10.44.252.2 -d
>>192.168.1.11 -j DNAT --to-destination 192.168.2.11
>>
>>simonl@pc $ traceroute -q1 -I 192.168.1.11
>>traceroute to 192.168.1.11 (192.168.1.11), 30 hops max, 38 byte packets
>> 1 10.44.252.1 (10.44.252.1) 1.854 ms
>> 2 192.168.1.11 (192.168.1.11) 9.378 ms
>> 3 192.168.1.11 (192.168.1.11) 17.237 ms
>> 4 192.168.1.11 (192.168.1.11) 3.783 ms
>>
>>See?
>
>
> Yes. Strange. I think I'd like to see the output of "traceroute -q1 -I
> 192.168.2.11" (with or without the DNAT rule, shouldn't make any difference).
Note I managed to set up stuff so I do not need the SNAT rule anymore.
The firewall is a plain forwarding router now, except for the dnat rule.
It is what you would expect (same with and without dnat):
simonl@pc $ traceroute -q1 -I 192.168.2.11
traceroute to 192.168.2.11 (192.168.2.11), 30 hops max, 38 byte packets
1 10.44.252.1 (10.44.252.1) 1.095 ms
2 10.44.8.1 (10.44.8.1) 1.936 ms
3 192.168.44.1 (192.168.44.1) 6.036 ms
4 192.168.2.11 (192.168.2.11) 3.077 ms
> Also, can you put a packet sniffer such as ethereal on the link 10.44.8.10 -
> 10.44.8.1 to see what packets are really leaving your firewall to the rest of
> the network?
Sure, this is from the firewall, ethereal sniffing all interfaces with
filter "ip proto 1", with dnat, doing traceroute -q1 -I 192.168.1.11
(slightly prettyprinted):
No Source Destination Protocol Info
1 10.44.252.2 192.168.1.11 ICMP Echo (ping) request
2 10.44.252.1 10.44.252.2 ICMP Time-to-live exceeded
3 10.44.252.2 192.168.1.11 ICMP Echo (ping) request
4 10.44.252.2 192.168.2.11 ICMP Echo (ping) request
5 10.44.8.1 10.44.252.2 ICMP Time-to-live exceeded
6 192.168.1.11 10.44.252.2 ICMP Time-to-live exceeded
7 10.44.252.2 192.168.1.11 ICMP Echo (ping) request
8 10.44.252.2 192.168.2.11 ICMP Echo (ping) request
9 192.168.44.1 10.44.252.2 ICMP Time-to-live exceeded
10 192.168.1.11 10.44.252.2 ICMP Time-to-live exceeded
11 10.44.252.2 192.168.1.11 ICMP Echo (ping) request
12 10.44.252.2 192.168.2.11 ICMP Echo (ping) request
13 192.168.2.11 10.44.252.2 ICMP Echo (ping) reply
14 192.168.1.11 10.44.252.2 ICMP Echo (ping) reply
In my understanding line 5 means 10.44.8.1 sent back a ttl-exceeded as
it should.
The strange thing is on line 6. The ttl-exceeded packet is sent to the
pc, but at that point, the source adress has been changed to 192.168.1.11.
The corresponding output from traceroute'ing 192.168.2.11 is:
5 10.44.8.1 10.44.252.2 ICMP Time-to-live exceeded
6 10.44.8.1 10.44.252.2 ICMP Time-to-live exceeded
The ttl-exceeded packet is just forwarded, as expected.
I have attached libpcap dump files for traceroute'ing both hosts in case
it contains more relevant info.
I would like to set up a stealth sniffer between firewall and next-hop
router, but I do not know how, wish I still had a hub.
FYI kernel is 2.4.25.
Simon
[-- Attachment #2: traceroute -q1 -I 192.168.1.11.dump --]
[-- Type: application/octet-stream, Size: 1112 bytes --]
[-- Attachment #3: traceroute -q1 -I 192.168.2.11.dump --]
[-- Type: application/octet-stream, Size: 1112 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: DNAT hiding routers behind it
2004-08-07 14:47 ` Simon Lodal
@ 2004-08-11 20:29 ` Aleksandar Milivojevic
0 siblings, 0 replies; 8+ messages in thread
From: Aleksandar Milivojevic @ 2004-08-11 20:29 UTC (permalink / raw)
To: Simon Lodal; +Cc: netfilter
Simon Lodal wrote:
> I would like to set up a stealth sniffer between firewall and next-hop
> router, but I do not know how, wish I still had a hub.
You said your router is actually an ethernet switch (that have some
routing capabilities)? On most switches, you can assign one or more
ports to be monitoring ports. They will receive copy of all traffic
going through the switch. Check if your switch supports that.
Configure one port to be monitoring port, connect PC to it. Do not set
up IP address or anything on that interface, just bring it up with
ifconfig. Run tcpdump or such on that interface. And you have your
stealth sniffer.
--
Aleksandar Milivojevic <amilivojevic@pbl.ca> Pollard Banknote Limited
Systems Administrator 1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2004-08-11 20:29 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-08-06 17:25 DNAT hiding routers behind it Simon Lodal
2004-08-06 18:26 ` Dick St.Peters
2004-08-06 21:08 ` Simon Lodal
2004-08-06 22:56 ` Antony Stone
2004-08-07 2:51 ` Simon Lodal
2004-08-07 7:37 ` Antony Stone
2004-08-07 14:47 ` Simon Lodal
2004-08-11 20:29 ` Aleksandar Milivojevic
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox