Re: Private traffic seen on public NATed interface - Linux 2.6.10-11 tested

[Francesco Ciocchetti <primero@fastwebnet.it>]

James MacLean wrote:

> Hi Folks,
>
> Today we noticed that some traffic appears to be getting by netfilter 
> unNATed. The computers use typical SNATing such as :
>
> iptables -t nat -I POSTROUTING -j SNAT -s <private ip space> -o eth0 
> --to <IP of eth0>
>
a full , or almost full, iptables rules dump would be better.

> While we were dumping traffic on the public interface, we noticed 
> private IPs showing up in our dumps.
>
> We verified that there existed sessions between private IPs and public 
> Internet sites where some of the private traffic was returning to the 
> Internet site not NATed.
>
I hope that my "English knowledge' is joking me here ... how can be 
established session beetween you 'private IPs ' and Internet Server??
This is really impossible ... your packets, with private ip source, 
would never reach any internet server cause at least your ISP routers 
will surely filter on RFC 1918 addresses.

> We started watching, and saw this occur on servers with 2.6.11 and 
> 2.6.10 kernels which are all we have to test with.
>
> These kernels were compiled locally.
>
> For example, tcpdumping on a public interface where no private IPs 
> should live :
>
> 15:19:22.066190 IP 10.0.7.100.2640 > 142.176.33.171.http: R 
> 2946695981:2946695981(0) ack 4138631275 win 0
> 15:19:22.066516 IP 10.0.7.100.2641 > 142.176.33.170.http: R 
> 818314876:818314876(0) ack 4144245614 win 0
> 15:19:22.066684 IP 10.0.7.100.2638 > 142.176.33.170.http: R 
> 3381617258:3381617258(0) ack 4136231656 win 0
> 15:19:22.067353 IP 10.0.7.100.2639 > 142.176.33.170.http: R 
> 3920569986:3920569986(0) ack 4133397861 win 0
> 15:19:22.068045 IP 10.0.7.100.2642 > 142.176.33.170.http: R 
> 3340982500:3340982500(0) ack 4135371285 win 0
> 15:19:24.001820 IP 10.0.5.13.2023 > 65.54.194.118.http: F 0:0(0) ack 1 
> win 64790
>
>
this dump is really weird ... here we see packets from your private IP 
to public IP with RST and FIN flags ... how can you rst or fin a 
connection if you never established it? i would expect some SYN that 
never would get any ACK ... but RST and FIN are really really weird.

are you sure you have run tcpdump on public interface?

> Is there something we may have been setting up incorrectly?
> JES

i really think so :)

bye
P.