From: Eliezer Croitoru <eliezer@ngtech.co.il>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: "Steve (Telsat Broadband)" <steve@telsatbb.vu>,
netfilter@vger.kernel.org
Subject: Re: Deleting subnet range from conntrack
Date: Wed, 09 Jan 2013 15:50:01 +0200 [thread overview]
Message-ID: <50ED7589.6050900@ngtech.co.il> (raw)
In-Reply-To: <20130108035050.GA19114@1984>
Hey there,
A simple script that will invoke all conntrack sessions can do that and
it is not really advised to do that in a very busy gateway or allow
users trigger such event freely.
How exactly a AUTH processing listener works on data-grams? Just wondering?
In most cases UDP should be dropped to prevent this kind of issues.
Regards,
Eliezer
On 1/8/2013 5:50 AM, Pablo Neira Ayuso wrote:
> Hi Steve,
>
> On Tue, Jan 08, 2013 at 01:56:48PM +1100, Steve (Telsat Broadband) wrote:
>> Hi All,
>>
>> As part of a walled gateway I have written, the gateway is listening on both
>> TCP and UDP for incoming connections. For TCP, the connection is picked up
>> and authenticated and allowed to proceed through the gateway; this all
>> appears to work normally; however, under UDP, the unauthenticated data is
>> sent to the auth processing listener via a NAT 'REDIRECT' command. This
>> command then authenticates the data, BUT the problem is that UDP data still
>> continues to be redirected to the auth processor even after authorisation.
>>
>> If have found that if I run a 'conntrack -D -s xxx.xxx.xxx.xxx' on the IP in
>> question, the UDP data then flows through as expected. The problem is, that
>> for some instances, I'm needing the authorise/permit a subnet or network
>> xxx.xxx.xxx.xxx/xx or and IPv6 subnet and it appears that conntrack doesn't
>> support this.
>>
>> Is there a way to get around this and delete conntrack entries for the
>> subnet?
>
> Unfortunately not yet. But it is doable.
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
prev parent reply other threads:[~2013-01-09 13:50 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-08 2:56 Deleting subnet range from conntrack Steve (Telsat Broadband)
2013-01-08 3:50 ` Pablo Neira Ayuso
2013-01-09 13:50 ` Eliezer Croitoru [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50ED7589.6050900@ngtech.co.il \
--to=eliezer@ngtech.co.il \
--cc=netfilter@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=steve@telsatbb.vu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox