Linux Netfilter discussions
 help / color / mirror / Atom feed
* 2 NICs on same subnet
@ 2004-11-05 12:38 Sven Schuster
  2004-11-05 12:41 ` Marc Haber
                   ` (2 more replies)
  0 siblings, 3 replies; 18+ messages in thread
From: Sven Schuster @ 2004-11-05 12:38 UTC (permalink / raw)
  To: netfilter

[-- Attachment #1: Type: text/plain, Size: 1355 bytes --]


Hi everybody,

I have a problem which I'm quite sure can be resolved easily, but
at the moment I'm lacking the "how" :-)
I have a machine (RH ES 3) with two Intel e1000 cards attached to
a gigabit switch, each interface is assigned an IP address on the
same subnet (say 1.2.3.4 on eth0 and 1.2.3.5 on eth1).
What's happening is that if a connection to either of these addresses
is made, it's always received via the same interface (eth1 most of the
time), and the replies go out via this interface, too. But what I'd
like is that packets to 1.2.3.4 come in via eth0 and packets to 1.2.3.5
come in via eth1 and that replies from 1.2.3.4 leave via eth0, from
1.2.3.5 via eth1.
I've already tried to resolve this issue with arptables, doing

arptables -N eth0
arptables -A eth0 -d 1.2.3.4 -j ACCEPT
arptables -A eth0 -j DROP
arptables -N eth1
arptables -A eth1 -d 1.2.3.5 -j ACCEPT
arptables -A eth1 -j DROP
arptables -A IN -i eth0 -j eth0
arptables -A IN -i eth1 -j eth1

and additionally limiting traffic in the same way by iptables, but
that doesn't work unfortunately.
Has anybody done this?? Is a solution to this problem known??


Thanks in advance!!

Sven

-- 
Linux zion 2.6.9-rc1-mm4 #1 Tue Sep 7 12:57:19 CEST 2004 i686 athlon i386 GNU/Linux
 13:30:13 up 1 day, 16:58,  1 user,  load average: 0.08, 0.02, 0.01

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

^ permalink raw reply	[flat|nested] 18+ messages in thread
* RE: 2 NICs on same subnet
@ 2004-11-05 13:00 Scott Knake
  2004-11-05 13:21 ` Sven Schuster
  0 siblings, 1 reply; 18+ messages in thread
From: Scott Knake @ 2004-11-05 13:00 UTC (permalink / raw)
  To: netfilter

Well as far as outbound data that should be determined by your routing
table if I'm not mistaken. Maybe route -n will give you a clue but I
worked with someone on this same issue last night and never got to the
bottom of it. Be sure to post what you find :)

-Scott

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Sven
Schuster
Sent: Friday, November 05, 2004 7:39 AM
To: netfilter@lists.netfilter.org
Subject: 2 NICs on same subnet


Hi everybody,

I have a problem which I'm quite sure can be resolved easily, but
at the moment I'm lacking the "how" :-)
I have a machine (RH ES 3) with two Intel e1000 cards attached to
a gigabit switch, each interface is assigned an IP address on the
same subnet (say 1.2.3.4 on eth0 and 1.2.3.5 on eth1).
What's happening is that if a connection to either of these addresses
is made, it's always received via the same interface (eth1 most of the
time), and the replies go out via this interface, too. But what I'd
like is that packets to 1.2.3.4 come in via eth0 and packets to 1.2.3.5
come in via eth1 and that replies from 1.2.3.4 leave via eth0, from
1.2.3.5 via eth1.
I've already tried to resolve this issue with arptables, doing

arptables -N eth0
arptables -A eth0 -d 1.2.3.4 -j ACCEPT
arptables -A eth0 -j DROP
arptables -N eth1
arptables -A eth1 -d 1.2.3.5 -j ACCEPT
arptables -A eth1 -j DROP
arptables -A IN -i eth0 -j eth0
arptables -A IN -i eth1 -j eth1

and additionally limiting traffic in the same way by iptables, but
that doesn't work unfortunately.
Has anybody done this?? Is a solution to this problem known??


Thanks in advance!!

Sven

-- 
Linux zion 2.6.9-rc1-mm4 #1 Tue Sep 7 12:57:19 CEST 2004 i686 athlon
i386 GNU/Linux
 13:30:13 up 1 day, 16:58,  1 user,  load average: 0.08, 0.02, 0.01


^ permalink raw reply	[flat|nested] 18+ messages in thread
* RE: 2 NICs on same subnet
@ 2004-11-05 18:45 Daniel Chemko
  2004-11-05 19:16 ` Sven Schuster
  0 siblings, 1 reply; 18+ messages in thread
From: Daniel Chemko @ 2004-11-05 18:45 UTC (permalink / raw)
  To: a.ledvinka, schuster.sven, netfilter

Ok, here's my two cents. There IS a solution, I can feel it. I'm just
going to work through it through talking, and hope for the best. (Note,
Although not totally in topic, the solution is in fact)

1. You're getting inbound responses on the wrong NIC because you're
sending IP requests from the wrong device. The Switch thinks that NIC 1
does have IP #2 (AKA: Accidental ARP poison). 
2. I'm assuming you're using this for either an extra security mechanism
or for a backup line
3. I'm assuming that the machine is standalone and is not hosting
services behind it. Lets just throw that complexity out the window.

So, the real thing you need to do is FORCE packets to/from IP1 in/out of
IF1 and packets to/from IP2 in/out of IF2.


Solution Overview

1. Application Layer
When you start your application, you must bind inbound/outbound traffic
to a specific port. If your software doesn't support this, you could
setup a local proxy server to do it.

2. Firewall Layer
When packets sourced as either IP1 or IP2 come into the OUTPUT chain,
mark it accordingly.

3. Routing Layer
Read the mark on the packets coming down the pipe (Firewall OUTPUT) and
direct the packets out the correct interface

4. Datalink Layer 
We must flush out all ARP caches on any devices that may have been
poisoned after everything else has been complete. This usually means
turning off/on the network switch.


Implementation details

Step 1. Routing Tables
Your routing tables should probably look like the following if it was
setup default.

192.168.1.0/24 dev eth0  scope link 
192.168.1.0/24 dev eth1  scope link 
127.0.0.0/8 dev lo  scope link 
default via 192.168.1.254 dev eth0 
default via 192.168.1.254 dev eth1

As you can see here, there's nothing FORCING the packets to go out
either of the interfaces. Lets create a couple tables that will FORCE
the traffic to one interface or the other.

# Create a couple tables that will match against firewall MARK rules and
direct them to new tables
   ip rule add table 1 fwmark 1
   ip rule add table 2 fwmark 2

# Create the new tables to have 1 single route (I'm assuming there are
no other routes!)
   ip route add default dev ${IF_1} table 1 src ${SRC_IP_1}
   ip route add default dev ${IF_2} table 2 src ${SRC_IP_2}

All done. That takes care of the routing. Now to activate the routing
code: Firewalls

Step 2. Firewall Layer

In order for all this to work, we need to mark packets that come in/out
of the system on the correct ports. Since we don't have any other
routes, I'm going to make this simple. If you want to be totally
correct, I think the CONNMARK rule would be better, but worry about it
after everything already works.

# Mark packets from a source address to a specific MARK
   iptables -t mangle -A OUTPUT --source ${SRC_IP_1} -j MARK 1
   iptables -t mangle -A OUTPUT --source ${SRC_IP_2} -j MARK 2
# If we get here without hitting one of the above rules, I'm going to
take a default route from the 'main' routing table

# Make sure that no matter what don't send packets with the wrong
routing out unfettered
   iptables -t nat -A POSTROUTING -o ${IF_1} -j SNAT --to ${IP_1}
   iptables -t nat -A POSTROUTING -o ${IF_2} -j SNAT --to ${IP_2}


Step 3. Application Layer

Notice that in the firewall layer it used the --source to determine what
MARK to assign. Any normal connection coming from the socket layer
generally doesn't set the internet address source of the connection. If
you know socket coding, you usually call socket then connect when a
client connects to a server. Neither of these commands specify the
IP/Port that you are connecting FROM. If your tool doesn't allow you to
specify a src ip/port to connect from, you have issues.

One workaround that I came across was Squid Proxy. It does allow you to
hard code the source address of the external connection by specifying
tcp_outgoing_address. If your tool allows you to specify a proxy server,
this could be your solution. If your tool doesn't allow you to specify
the proxy / src ip of the connection, you may need to explore other
alternatives.



^ permalink raw reply	[flat|nested] 18+ messages in thread
end of thread, other threads:[~2004-11-06  0:05 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-11-05 12:38 2 NICs on same subnet Sven Schuster
2004-11-05 12:41 ` Marc Haber
2004-11-05 12:54   ` Sven Schuster
2004-11-05 13:04     ` Marc Haber
2004-11-05 14:22       ` Sven Schuster
2004-11-05 14:52         ` Lumberjack
2004-11-05 15:25         ` Jason Opperisano
2004-11-05 15:32         ` John A. Sullivan III
2004-11-05 14:12 ` Jason Opperisano
2004-11-05 14:47 ` Aleksandar Milivojevic
2004-11-05 14:51   ` Aleksandar Milivojevic
2004-11-05 17:07   ` a.ledvinka
  -- strict thread matches above, loose matches on Subject: below --
2004-11-05 13:00 Scott Knake
2004-11-05 13:21 ` Sven Schuster
2004-11-05 18:45 Daniel Chemko
2004-11-05 19:16 ` Sven Schuster
2004-11-05 23:37   ` Jorge Nerín
2004-11-06  0:05     ` George Alexandru Dragoi

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox