From: Simon Lodal <simonl@parknet.dk>
To: netfilter@lists.netfilter.org
Subject: Re: DNAT hiding routers behind it
Date: Sat, 07 Aug 2004 16:47:48 +0200 [thread overview]
Message-ID: <4114EB94.8050004@parknet.dk> (raw)
In-Reply-To: <200408070837.38949.Antony@Soft-Solutions.co.uk>
[-- Attachment #1: Type: text/plain, Size: 3437 bytes --]
>>simonl@pc $ traceroute -q1 -I 192.168.1.11
>>traceroute to 192.168.1.11 (192.168.1.11), 30 hops max, 38 byte packets
>> 1 10.44.252.1 (10.44.252.1) 4.297 ms
>> 2 10.44.8.1 (10.44.8.1) 3.892 ms
>> 3 192.168.44.1 (192.168.44.1) 4.826 ms
>> 4 192.168.1.11 (192.168.1.11) 5.095 ms
>>
>>All good. Now for the fun (dnat to another host at similar distance):
>>root@fw # iptables -t nat -A PREROUTING -i vmnet2 -s 10.44.252.2 -d
>>192.168.1.11 -j DNAT --to-destination 192.168.2.11
>>
>>simonl@pc $ traceroute -q1 -I 192.168.1.11
>>traceroute to 192.168.1.11 (192.168.1.11), 30 hops max, 38 byte packets
>> 1 10.44.252.1 (10.44.252.1) 1.854 ms
>> 2 192.168.1.11 (192.168.1.11) 9.378 ms
>> 3 192.168.1.11 (192.168.1.11) 17.237 ms
>> 4 192.168.1.11 (192.168.1.11) 3.783 ms
>>
>>See?
>
>
> Yes. Strange. I think I'd like to see the output of "traceroute -q1 -I
> 192.168.2.11" (with or without the DNAT rule, shouldn't make any difference).
Note I managed to set up stuff so I do not need the SNAT rule anymore.
The firewall is a plain forwarding router now, except for the dnat rule.
It is what you would expect (same with and without dnat):
simonl@pc $ traceroute -q1 -I 192.168.2.11
traceroute to 192.168.2.11 (192.168.2.11), 30 hops max, 38 byte packets
1 10.44.252.1 (10.44.252.1) 1.095 ms
2 10.44.8.1 (10.44.8.1) 1.936 ms
3 192.168.44.1 (192.168.44.1) 6.036 ms
4 192.168.2.11 (192.168.2.11) 3.077 ms
> Also, can you put a packet sniffer such as ethereal on the link 10.44.8.10 -
> 10.44.8.1 to see what packets are really leaving your firewall to the rest of
> the network?
Sure, this is from the firewall, ethereal sniffing all interfaces with
filter "ip proto 1", with dnat, doing traceroute -q1 -I 192.168.1.11
(slightly prettyprinted):
No Source Destination Protocol Info
1 10.44.252.2 192.168.1.11 ICMP Echo (ping) request
2 10.44.252.1 10.44.252.2 ICMP Time-to-live exceeded
3 10.44.252.2 192.168.1.11 ICMP Echo (ping) request
4 10.44.252.2 192.168.2.11 ICMP Echo (ping) request
5 10.44.8.1 10.44.252.2 ICMP Time-to-live exceeded
6 192.168.1.11 10.44.252.2 ICMP Time-to-live exceeded
7 10.44.252.2 192.168.1.11 ICMP Echo (ping) request
8 10.44.252.2 192.168.2.11 ICMP Echo (ping) request
9 192.168.44.1 10.44.252.2 ICMP Time-to-live exceeded
10 192.168.1.11 10.44.252.2 ICMP Time-to-live exceeded
11 10.44.252.2 192.168.1.11 ICMP Echo (ping) request
12 10.44.252.2 192.168.2.11 ICMP Echo (ping) request
13 192.168.2.11 10.44.252.2 ICMP Echo (ping) reply
14 192.168.1.11 10.44.252.2 ICMP Echo (ping) reply
In my understanding line 5 means 10.44.8.1 sent back a ttl-exceeded as
it should.
The strange thing is on line 6. The ttl-exceeded packet is sent to the
pc, but at that point, the source adress has been changed to 192.168.1.11.
The corresponding output from traceroute'ing 192.168.2.11 is:
5 10.44.8.1 10.44.252.2 ICMP Time-to-live exceeded
6 10.44.8.1 10.44.252.2 ICMP Time-to-live exceeded
The ttl-exceeded packet is just forwarded, as expected.
I have attached libpcap dump files for traceroute'ing both hosts in case
it contains more relevant info.
I would like to set up a stealth sniffer between firewall and next-hop
router, but I do not know how, wish I still had a hub.
FYI kernel is 2.4.25.
Simon
[-- Attachment #2: traceroute -q1 -I 192.168.1.11.dump --]
[-- Type: application/octet-stream, Size: 1112 bytes --]
[-- Attachment #3: traceroute -q1 -I 192.168.2.11.dump --]
[-- Type: application/octet-stream, Size: 1112 bytes --]
next prev parent reply other threads:[~2004-08-07 14:47 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-08-06 17:25 DNAT hiding routers behind it Simon Lodal
2004-08-06 18:26 ` Dick St.Peters
2004-08-06 21:08 ` Simon Lodal
2004-08-06 22:56 ` Antony Stone
2004-08-07 2:51 ` Simon Lodal
2004-08-07 7:37 ` Antony Stone
2004-08-07 14:47 ` Simon Lodal [this message]
2004-08-11 20:29 ` Aleksandar Milivojevic
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4114EB94.8050004@parknet.dk \
--to=simonl@parknet.dk \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox