Mangling and blocking

Mangling and blocking

[Steve Hill]

[-- Attachment #1: Type: text/plain, Size: 2482 bytes --]


I'm writing some fairly complex firewall rules, which will be 
controllable through a GUI.  The basic requirement is:

1. The user can select whether or not to allow some traffic.
2. Traffic the user has opted to disallow, will be directed at a 
transparent proxy, if there is a suitable proxy, otherwise it will be 
dropped.  This is done by setting a MARK on the traffic and applying 
special routing to it.

I can obviously construct rules to make a decision about 
allowing/blocking traffic and apply them to the FORWARD chain in the 
filter table.  However, the rules to make a decision about what gets 
sent to the transparent proxy are almost identical to the filtering 
rules, but iptables only lets you MARK in the mangle table - this means 
I need to duplicate all the filter rules into the mangle table, which 
seems like a very inefficient way of doing things when there are a large 
number of rules.

Doing any kind of filtering in the mangle table seems to be strongly 
discouraged, so I'm looking for some advice on the best way to approach 
this.  What are the problems associated with either filtering in the 
mangle table's PREROUTING chain, or at least just having mangle rules to 
MARK packets that are to be allowed and then rules in the filter table 
that allow/drop based on that MARK?

 From looking at 
https://upload.wikimedia.org/wikipedia/commons/thumb/3/37/Netfilter-packet-flow.svg/2000px-Netfilter-packet-flow.svg.png 
it looks like:
- mangle:PREROUTING will carry both INPUT and FORWARD traffic, so care 
would need to be taken to ensure the rules are acting on the right traffic.
- mangle:PREROUTING rules won't be able to use -o, whereas 
filter:FORWARD could.
- mangle:PREROUTING will happen before any NAT, so some traffic would 
have the "wrong" addresses on it.


Secondly, am I right in thinking that a MARK that affects routing needs 
to be set in mangle:PREROUTING - i.e. by the time mangle:FORWARD is 
traversed, its too late?


Thanks.

-- 
  - Steve Hill
    Technical Director
    Opendium Limited     http://www.opendium.com

Direct contacts:
    Instant messager: xmpp:steve@opendium.com
    Email:            steve@opendium.com
    Phone:            sip:steve@opendium.com

Sales / enquiries contacts:
    Email:            sales@opendium.com
    Phone:            +44-1792-824568 / sip:sales@opendium.com

Support contacts:
    Email:            support@opendium.com
    Phone:            +44-1792-825748 / sip:support@opendium.com

[-- Attachment #2: steve.vcf --]
[-- Type: text/x-vcard, Size: 283 bytes --]

begin:vcard
fn:Steve Hill
n:Hill;Steve
org:Opendium Limited
adr:1 Brue Close;;Highfield House;Bruton;Somerset;BA10 0HY;England
email;internet:steve@opendium.com
title:Technical Director
tel;work:+44-1792-824568
x-mozilla-html:FALSE
url:http://www.opendium.com
version:2.1
end:vcard

RE: Mangling and blocking

[André Paulsberg-Csibi]

There is too few details about what you are exactly trying to do ( and what users are allowed to do in the GUI ),
but from my standpoint it seems like you would want to make a logic choice as the where you decide where packets should go .
IF it was me I think I would use the MARK to decide what should happen on basic levels , and most likely it would be something like this :

MARK "1" is traffic for PROXY
MARK "2" is "USER CHOSEN RULES"
MARK "4" is some sort of exceptions , that needs special care ...
All other packets ( MARK 0 ) I would just DROP

Sorry for no specific examples , but that would require some more details ...

As for a general rule , I would most likely redirect the following:
TCP port 21 , 80 and 443 to a squid proxy ( or other WEB/FTP proxy )
TCP and UDP 53 to a DNS server 
UDP 123 to a NTP server

As for the exceptions , that is for instance DHCP packets or ICMP packets required to allow normal flows and setup for the users .
And any destination you would always block , like MGMT systems or your GW/FW interfaces .
may also be you would like to block tunneling protocols - like IKE , TEREDO or SSH and some ICMP types that can redirect or mess with systems .


Best regards
André Paulsberg-Csibi
Senior Network Engineer 
Fault Handling
EVRY Nordic Operations AS
andre.paulsberg-csibi@evry.com
M +47 9070 5988



-----Original Message-----
From: netfilter-owner@vger.kernel.org [mailto:netfilter-owner@vger.kernel.org] On Behalf Of Steve Hill
Sent: 14. juli 2015 16:20
To: netfilter@vger.kernel.org
Subject: Mangling and blocking


I'm writing some fairly complex firewall rules, which will be 
controllable through a GUI.  The basic requirement is:

1. The user can select whether or not to allow some traffic.
2. Traffic the user has opted to disallow, will be directed at a 
transparent proxy, if there is a suitable proxy, otherwise it will be 
dropped.  This is done by setting a MARK on the traffic and applying 
special routing to it.

I can obviously construct rules to make a decision about 
allowing/blocking traffic and apply them to the FORWARD chain in the 
filter table.  However, the rules to make a decision about what gets 
sent to the transparent proxy are almost identical to the filtering 
rules, but iptables only lets you MARK in the mangle table - this means 
I need to duplicate all the filter rules into the mangle table, which 
seems like a very inefficient way of doing things when there are a large 
number of rules.

Doing any kind of filtering in the mangle table seems to be strongly 
discouraged, so I'm looking for some advice on the best way to approach 
this.  What are the problems associated with either filtering in the 
mangle table's PREROUTING chain, or at least just having mangle rules to 
MARK packets that are to be allowed and then rules in the filter table 
that allow/drop based on that MARK?

 From looking at 
https://upload.wikimedia.org/wikipedia/commons/thumb/3/37/Netfilter-packet-flow.svg/2000px-Netfilter-packet-flow.svg.png 
it looks like:
- mangle:PREROUTING will carry both INPUT and FORWARD traffic, so care 
would need to be taken to ensure the rules are acting on the right traffic.
- mangle:PREROUTING rules won't be able to use -o, whereas 
filter:FORWARD could.
- mangle:PREROUTING will happen before any NAT, so some traffic would 
have the "wrong" addresses on it.


Secondly, am I right in thinking that a MARK that affects routing needs 
to be set in mangle:PREROUTING - i.e. by the time mangle:FORWARD is 
traversed, its too late?


Thanks.

-- 
  - Steve Hill
    Technical Director
    Opendium Limited     http://www.opendium.com

Direct contacts:
    Instant messager: xmpp:steve@opendium.com
    Email:            steve@opendium.com
    Phone:            sip:steve@opendium.com

Sales / enquiries contacts:
    Email:            sales@opendium.com
    Phone:            +44-1792-824568 / sip:sales@opendium.com

Support contacts:
    Email:            support@opendium.com
    Phone:            +44-1792-825748 / sip:support@opendium.com