* Re: (DHCP) Ebtables ruleset isn't working, any ideas?
@ 2009-05-20 12:32 Miguel Ghobangieno
2009-05-20 12:35 ` Jozsef Kadlecsik
2009-05-20 13:58 ` Jozsef Kadlecsik
0 siblings, 2 replies; 7+ messages in thread
From: Miguel Ghobangieno @ 2009-05-20 12:32 UTC (permalink / raw)
To: Jozsef Kadlecsik; +Cc: netfilter
I can't get DHCP to work through the firewall, I've tried everything, even:
ebtables -A FORWARD -p IPv4 --ip-sport 67:68 -j ACCEPT
ebtables -A FORWARD -p IPv4 --ip-dport 67:68 -j ACCEPT
Other things I tried:
ebtables -A FORWARD -i eth0 -o eth1 -p 0x800 --ip-src 192.168.0.1 --ip-proto udp --ip-sport 67:68 -j ACCEPT
ebtables -A FORWARD -i eth1 -o eth0 -p 0x800 --ip-dst 255.255.255.255/255.255.255.255 --ip-proto udp --ip-dport 67:68 -j ACCEPT
and before that:
ebtables -A FORWARD -p 0x800 --ip-src 192.168.0.1 --ip-proto udp --ip-sport 68 -j ACCEPT
ebtables -A FORWARD -p 0x800 --ip-dst 192.168.0.1 --ip-proto udp --ip-dport 67 -j ACCEPT
--- On Wed, 5/20/09, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> wrote:
> From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> Subject: Re: Ebtables ruleset isn't working, any ideas?
> To: "Miguel Ghobangieno" <mikeeusa@yahoo.com>
> Cc: netfilter@vger.kernel.org
> Date: Wednesday, May 20, 2009, 7:24 AM
> On Tue, 19 May 2009, Miguel
> Ghobangieno wrote:
>
> > Ok I broke the rules up, and I used the hex value for
> the protocals
> > rather than the ascii "IP" etc; it workes now. This is
> a debian stable
> > box, I guess the ebtables that comes in apt is too
> ancient. I would like
> > to log everyone who attepts to access port 22 tcp on
> eth2 though (allow
> > them through but log).
>
> If `ebtables -h log` does not produce the help text of the
> log watcher,
> then you have to install ebtables manually, to get the
> required logging
> functionality.
>
> Best regards,
> Jozsef
> -
> E-mail : kadlec@blackhole.kfki.hu,
> kadlec@mail.kfki.hu
> PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
> Address : KFKI Research Institute for Particle and Nuclear
> Physics
> H-1525 Budapest 114,
> POB. 49, Hungary
>
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: (DHCP) Ebtables ruleset isn't working, any ideas?
2009-05-20 12:32 (DHCP) Ebtables ruleset isn't working, any ideas? Miguel Ghobangieno
@ 2009-05-20 12:35 ` Jozsef Kadlecsik
2009-05-20 13:58 ` Jozsef Kadlecsik
1 sibling, 0 replies; 7+ messages in thread
From: Jozsef Kadlecsik @ 2009-05-20 12:35 UTC (permalink / raw)
To: Miguel Ghobangieno; +Cc: netfilter
On Wed, 20 May 2009, Miguel Ghobangieno wrote:
> I can't get DHCP to work through the firewall, I've tried everything, even:
> ebtables -A FORWARD -p IPv4 --ip-sport 67:68 -j ACCEPT
> ebtables -A FORWARD -p IPv4 --ip-dport 67:68 -j ACCEPT
>
> Other things I tried:
> ebtables -A FORWARD -i eth0 -o eth1 -p 0x800 --ip-src 192.168.0.1 --ip-proto udp --ip-sport 67:68 -j ACCEPT
> ebtables -A FORWARD -i eth1 -o eth0 -p 0x800 --ip-dst 255.255.255.255/255.255.255.255 --ip-proto udp --ip-dport 67:68 -j ACCEPT
>
> and before that:
> ebtables -A FORWARD -p 0x800 --ip-src 192.168.0.1 --ip-proto udp --ip-sport 68 -j ACCEPT
> ebtables -A FORWARD -p 0x800 --ip-dst 192.168.0.1 --ip-proto udp --ip-dport 67 -j ACCEPT
What is your kernel version? What is your ebtables version?
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: (DHCP) Ebtables ruleset isn't working, any ideas?
2009-05-20 12:32 (DHCP) Ebtables ruleset isn't working, any ideas? Miguel Ghobangieno
2009-05-20 12:35 ` Jozsef Kadlecsik
@ 2009-05-20 13:58 ` Jozsef Kadlecsik
1 sibling, 0 replies; 7+ messages in thread
From: Jozsef Kadlecsik @ 2009-05-20 13:58 UTC (permalink / raw)
To: Miguel Ghobangieno; +Cc: netfilter
On Wed, 20 May 2009, Miguel Ghobangieno wrote:
> I can't get DHCP to work through the firewall, I've tried everything, even:
> ebtables -A FORWARD -p IPv4 --ip-sport 67:68 -j ACCEPT
> ebtables -A FORWARD -p IPv4 --ip-dport 67:68 -j ACCEPT
You deduced that you have to use numbers and not names. Why don't you
follow that? Probably you need
ebtables -A FORWARD -p 0x800 --ip-proto udp --ip-sport 67:68 -j ACCEPT
But it's really strange and suspicious that names do not work,
something is really broken on your system. Have you got a correct
/etc/ethertypes file? Does you run the ebtables commands in chroot?
> Other things I tried:
> ebtables -A FORWARD -i eth0 -o eth1 -p 0x800 --ip-src 192.168.0.1 --ip-proto udp --ip-sport 67:68 -j ACCEPT
> ebtables -A FORWARD -i eth1 -o eth0 -p 0x800 --ip-dst 255.255.255.255/255.255.255.255 --ip-proto udp --ip-dport 67:68 -j ACCEPT
Could you draw the topology of your network? For example, if your firewall
is the dhcp server, then the chains are definitely wrong above. Or maybe
the interfaces are mixed up.
Why don't you log the packets??
> and before that:
> ebtables -A FORWARD -p 0x800 --ip-src 192.168.0.1 --ip-proto udp --ip-sport 68 -j ACCEPT
> ebtables -A FORWARD -p 0x800 --ip-dst 192.168.0.1 --ip-proto udp --ip-dport 67 -j ACCEPT
These rules makes no sense to me.
> Kernel (newest stable w/grsecurity patch):
>
> 2.6.29.3-grsec
If you have got grsecurity enabled and the dhcp server runs on the
firewall, then grsec must be tuned too.
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: (DHCP) Ebtables ruleset isn't working, any ideas?
@ 2009-05-20 13:21 Miguel Ghobangieno
0 siblings, 0 replies; 7+ messages in thread
From: Miguel Ghobangieno @ 2009-05-20 13:21 UTC (permalink / raw)
To: Jozsef Kadlecsik; +Cc: netfilter
Kernel (newest stable w/grsecurity patch):
2.6.29.3-grsec
title Debian GNU/Linux, kernel 2.6.29.3-grsec
#lock
root (hd0,0)
kernel /boot/vmlinuz-2.6.29.3-grsec root=/dev/sda1 ro quiet
initrd /boot/initrd-2.6.29.3.img
Ebtables (Debian ancient!)
ebtables v2.0.8-2 (May 2007)
--- On Wed, 5/20/09, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> wrote:
> From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> Subject: Re: (DHCP) Ebtables ruleset isn't working, any ideas?
> To: "Miguel Ghobangieno" <mikeeusa@yahoo.com>
> Cc: netfilter@vger.kernel.org
> Date: Wednesday, May 20, 2009, 12:35 PM
> On Wed, 20 May 2009, Miguel
> Ghobangieno wrote:
>
> > I can't get DHCP to work through the firewall, I've
> tried everything, even:
> > ebtables -A FORWARD -p IPv4 --ip-sport 67:68 -j
> ACCEPT
> > ebtables -A FORWARD -p IPv4 --ip-dport 67:68 -j
> ACCEPT
> >
> > Other things I tried:
> > ebtables -A FORWARD -i eth0 -o eth1 -p 0x800 --ip-src
> 192.168.0.1 --ip-proto udp --ip-sport 67:68 -j ACCEPT
> > ebtables -A FORWARD -i eth1 -o eth0 -p 0x800 --ip-dst
> 255.255.255.255/255.255.255.255 --ip-proto udp --ip-dport
> 67:68 -j ACCEPT
> >
> > and before that:
> > ebtables -A FORWARD -p 0x800 --ip-src 192.168.0.1
> --ip-proto udp --ip-sport 68 -j ACCEPT
> > ebtables -A FORWARD -p 0x800 --ip-dst 192.168.0.1
> --ip-proto udp --ip-dport 67 -j ACCEPT
>
> What is your kernel version? What is your ebtables
> version?
>
> Best regards,
> Jozsef
> -
> E-mail : kadlec@blackhole.kfki.hu,
> kadlec@mail.kfki.hu
> PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
> Address : KFKI Research Institute for Particle and Nuclear
> Physics
> H-1525 Budapest 114,
> POB. 49, Hungary
>
^ permalink raw reply [flat|nested] 7+ messages in thread[parent not found: <805815.64593.qm@web44802.mail.sp1.yahoo.com>]
* Re: (DHCP) Ebtables ruleset isn't working, any ideas?
[not found] <805815.64593.qm@web44802.mail.sp1.yahoo.com>
@ 2009-05-20 17:03 ` Jozsef Kadlecsik
0 siblings, 0 replies; 7+ messages in thread
From: Jozsef Kadlecsik @ 2009-05-20 17:03 UTC (permalink / raw)
To: Miguel Ghobangieno; +Cc: netfilter
[-- Attachment #1: Type: TEXT/PLAIN, Size: 1031 bytes --]
On Wed, 20 May 2009, Miguel Ghobangieno wrote:
> Those are various rules I've tried. I've tried the hex, then when that
> didn't work I tried the "ip and IPv4" stuff. None worked.
>
> Here is the test network currently:
> laptop---(crossover
> cable)-->[eth1](BridgingFirewall[Br0])[eth0]---->[192.168.0.1](Linksys
> router)--->[Internet]
OK. So the linksys box is the dhcp server.
> But it's really strange and suspicious that names do not work,
> something is really broken on your system. Have you got a
> correct
> /etc/ethertypes file? Does you run the ebtables commands in
> chroot?
Why don't you check that file?
> Why don't you log the packets??
Third times I write: why don't you log the packets?
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: (DHCP) Ebtables ruleset isn't working, any ideas?
@ 2009-05-20 18:42 Miguel Ghobangieno
2009-05-20 20:22 ` Jozsef Kadlecsik
0 siblings, 1 reply; 7+ messages in thread
From: Miguel Ghobangieno @ 2009-05-20 18:42 UTC (permalink / raw)
To: Jozsef Kadlecsik; +Cc: netfilter
I did log, with tcpdump though (ethertype file seems fine, shown below):
debian-firewall-0:/etc/Bastille# tcpdump -i br0
tcpdump: WARNING: br0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 96 bytes
01:21:53.041277 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request
01:21:56.041145 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request
01:21:59.041106 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request
01:22:06.041040 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request
01:22:09.040964 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request
01:22:17.036982 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request
01:22:28.036967 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request
01:22:37.060312 arp who-has 192.168.0.1 tell 192.168.0.21
01:22:37.060750 arp reply 192.168.0.1 is-at 00:06:25:f0:2e:fd (oui Unknown)
01:22:37.060898 IP 192.168.0.21 > 192.168.0.1: ICMP echo request, id 53019, seq
01:22:37.064312 IP 192.168.0.21 > IGMP.MCAST.NET: igmp v3 report, 1 group record
01:22:37.297162 IP 192.168.0.21.mdns > 224.0.0.251.mdns: 0 [3q] [5n][|domain]
01:22:37.340502 IP 192.168.0.21.mdns > 224.0.0.251.mdns: 0*- [0q] 2/0/0 PTR[|dom
01:22:37.548553 IP 192.168.0.21.mdns > 224.0.0.251.mdns: 0 [3q] [5n][|domain]
01:22:37.800601 IP 192.168.0.21.mdns > 224.0.0.251.mdns: 0 [3q] [5n][|domain]
01:22:38.000694 IP 192.168.0.21.mdns > 224.0.0.251.mdns: 0*- [0q] 5/0/0[|domain]
01:22:38.528443 IP 192.168.0.21.mdns > 224.0.0.251.mdns: 0*- [0q] 5/0/0 PTR[|dom
01:22:39.188652 IP 192.168.0.21.mdns > 224.0.0.251.mdns: 0*- [0q] 5/0/0[|domain]
01:22:40.716560 IP 192.168.0.21.mdns > 224.0.0.251.mdns: 0*- [0q] 5/0/0 PTR[|dom
01:22:41.208356 IP 192.168.0.21 > IGMP.MCAST.NET: igmp v3 report, 1 group record
01:22:41.376602 IP 192.168.0.21.mdns > 224.0.0.251.mdns: 0*- [0q] 5/0/0[|domain]
01:22:45.629011 00:50:8b:11:82:f8 (oui Unknown) > Broadcast, ethertype Unknown (
0x0000: 1000 ffff ff01 0000 0000 0000 0000 0000 ................
0x0010: 0000 ..
01:22:45.629093 00:c0:4f:2d:5b:68 (oui Unknown) > Broadcast, ethertype Unknown (
0x0000: 1000 ffff ff01 0000 0000 0000 0000 0000 ................
0x0010: 0000 3535 3535 3535 3535 3535 3535 3535 ..55555555555555
0x0020: 3535 3535 3535 3535 3535 3535 3535 55555555555555
01:22:47.094032 arp who-has 169.254.5.88 tell 0.0.0.0
01:22:48.528175 arp who-has 169.254.5.88 tell 0.0.0.0
01:22:49.048433 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request
#
# Ethernet frame types
# This file describes some of the various Ethernet
# protocol types that are used on Ethernet networks.
#
# This list could be found on:
# http://www.iana.org/assignments/ethernet-numbers
#
# <name> <hexnumber> <alias1>...<alias35> #Comment
#
IPv4 0800 ip ip4 # Internet IP (IPv4)
X25 0805
ARP 0806 ether-arp #
FR_ARP 0808 # Frame Relay ARP [RFC1701]
BPQ 08FF # G8BPQ AX.25 Ethernet Packet
DEC 6000 # DEC Assigned proto
DNA_DL 6001 # DEC DNA Dump/Load
DNA_RC 6002 # DEC DNA Remote Console
DNA_RT 6003 # DEC DNA Routing
LAT 6004 # DEC LAT
DIAG 6005 # DEC Diagnostics
CUST 6006 # DEC Customer use
SCA 6007 # DEC Systems Comms Arch
TEB 6558 # Trans Ether Bridging [RFC1701]
RAW_FR 6559 # Raw Frame Relay [RFC1701]
AARP 80F3 # Appletalk AARP
ATALK 809B # Appletalk
802_1Q 8100 8021q 1q 802.1q dot1q # 802.1Q Virtual LAN tagged frame
IPX 8137 # Novell IPX
NetBEUI 8191 # NetBEUI
IPv6 86DD ip6 # IP version 6
PPP 880B # PPP
ATMMPOA 884C # MultiProtocol over ATM
PPP_DISC 8863 # PPPoE discovery messages
PPP_SES 8864 # PPPoE session messages
ATMFATE 8884 # Frame-based ATM Transport over Ethernet
LOOP 9000 loopback # loop proto
--- On Wed, 5/20/09, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> wrote:
> From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> Subject: Re: (DHCP) Ebtables ruleset isn't working, any ideas?
> To: "Miguel Ghobangieno" <mikeeusa@yahoo.com>
> Cc: netfilter@vger.kernel.org
> Date: Wednesday, May 20, 2009, 5:03 PM
> On Wed, 20 May 2009, Miguel
> Ghobangieno wrote:
>
> > Those are various rules I've tried. I've tried the
> hex, then when that
> > didn't work I tried the "ip and IPv4" stuff. None
> worked.
> >
> > Here is the test network currently:
> > laptop---(crossover
> >
> cable)-->[eth1](BridgingFirewall[Br0])[eth0]---->[192.168.0.1](Linksys
> > router)--->[Internet]
>
> OK. So the linksys box is the dhcp server.
>
> > But it's really strange
> and suspicious that names do not work,
> > something is really
> broken on your system. Have you got a
> > correct
> > /etc/ethertypes file?
> Does you run the ebtables commands in
> > chroot?
>
> Why don't you check that file?
>
> > Why don't you log the
> packets??
>
> Third times I write: why don't you log the packets?
>
> Best regards,
> Jozsef
> -
> E-mail : kadlec@blackhole.kfki.hu,
> kadlec@mail.kfki.hu
> PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
> Address : KFKI Research Institute for Particle and Nuclear
> Physics
> H-1525 Budapest 114,
> POB. 49, Hungary
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: (DHCP) Ebtables ruleset isn't working, any ideas?
2009-05-20 18:42 Miguel Ghobangieno
@ 2009-05-20 20:22 ` Jozsef Kadlecsik
0 siblings, 0 replies; 7+ messages in thread
From: Jozsef Kadlecsik @ 2009-05-20 20:22 UTC (permalink / raw)
To: Miguel Ghobangieno; +Cc: netfilter
On Wed, 20 May 2009, Miguel Ghobangieno wrote:
> I did log, with tcpdump though
Makes no use when rules are not working.
> (ethertype file seems fine, shown below):
Just for a simple test, I cut&paste one of your rules:
ebtables -A FORWARD -p IPv4 --ip-sport 67:68 -j ACCEPT
Why don't you pay attention to the error message(s) reported by ebtables?
> > > Why don't you log the packets??
> >
> > Third times I write: why don't you log the packets?
Fourth times: why don't you log the packets (by >>ebtables<<): insert a
just logging rule as the first one into the FORWARD chain and add logging
to every of your rules, with meaningful unique log prefixes everywhere.
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2009-05-20 20:22 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-05-20 12:32 (DHCP) Ebtables ruleset isn't working, any ideas? Miguel Ghobangieno
2009-05-20 12:35 ` Jozsef Kadlecsik
2009-05-20 13:58 ` Jozsef Kadlecsik
-- strict thread matches above, loose matches on Subject: below --
2009-05-20 13:21 Miguel Ghobangieno
[not found] <805815.64593.qm@web44802.mail.sp1.yahoo.com>
2009-05-20 17:03 ` Jozsef Kadlecsik
2009-05-20 18:42 Miguel Ghobangieno
2009-05-20 20:22 ` Jozsef Kadlecsik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox