Re: Filter out broadcast messages

Re: Filter out broadcast messages

[Gabby James]

Thanks Antony and Eric for the ideas.  Each idea has solved my problem, so 
it is just a matter of deciding which one to go with.  Thanks again!


>From: Antony Stone <Antony@Soft-Solutions.co.uk>
>To: netfilter@lists.netfilter.org
>Subject: Re: Filter out broadcast messages
>Date: Wed, 7 Jan 2004 22:05:29 +0000
>
>On Wednesday 07 January 2004 9:44 pm, Gabby James wrote:
>
> > Hi,
> >
> > I would like to filter out all broadcast messages.  The packets could 
>come
> > from 255.255.255.255 or multiple other addresses of the form 10.*.*.255.
> > What kind of syntax do I use to DROP these packets?  The line below will
> > filter out packets from 255.255.255.255 but I'm not sure what syntax to 
>use
> > to DROP the other adresses.
>
>Second idea:
>
>If you mean what you say, and the other broadcasts fit the pattern 
>10.*.*.255,
>you could always use the little-known but perfectly valid netmaslk
>255.0.0.255 in a rule such as:
>
>iptables -I INPUT -s 10.0.0.255/255.0.0.255 -j DROP
>
>This will do exactly what you asked - match packets where the source IP's
>first byte=10 and the last byte=255, with the middle two bytes being
>anything, and drop them.
>
>Antony.
>
>--
>Perfection in design is achieved not when there is nothing left to add, but
>rather when there is nothing left to take away.
>
>  - Antoine de Saint-Exupery
>
>                                                      Please reply to the 
>list;
>                                                            please don't CC 
>me.
>
>

_________________________________________________________________
Working moms: Find helpful tips here on managing kids, home, work —  and 
yourself.   http://special.msn.com/msnbc/workingmom.armx

iproute2 and fwmark usage

[Thhoep]

hi,

i have problems with the usage if netfilter marks in connection with
advanced routing using the iproute2 package. standing alone and using its
(lousy) inbuilt filter thingy iproute works normal, but trying to use
netfilter marks for routing decisions some pretty odd things happen. see for
yourself.


Routing tables (for this case uninteresting tables left out):

 router:~# ip route show table test
 217.5.98.133 dev ppp4  scope link  src 80.144.178.206
 192.168.0.0/24 dev eth4  scope link
 default via 217.5.98.133 dev ppp4

 router:~# ip route show table offline
 192.168.0.0/24 dev eth4  scope link
 unreachable default

 router:~# ip route show table main
 217.5.98.133 dev ppp0  proto kernel  scope link  src 80.144.190.200
 217.5.98.133 dev ppp1  proto kernel  scope link  src 80.144.188.142
 217.5.98.133 dev ppp2  proto kernel  scope link  src 80.144.179.55
 217.5.98.133 dev ppp5  proto kernel  scope link  src 80.144.184.186
 217.5.98.133 dev ppp4  proto kernel  scope link  src 80.144.178.206
 217.5.98.133 dev ppp3  proto kernel  scope link  src 80.144.188.180
 192.168.0.0/24 dev eth4  scope link
 default via 217.5.98.133 dev ppp0

Routing policies (for this case uninteresting rules left out):

 router:~# ip rule
 0:      from all lookup local
 1000:    from all fwmark        1 lookup test
 2000:   from 192.168.0.0/24 lookup offline
 32766:  from all lookup main
 32767:  from all lookup default

Netfilter configuration (for this case uninteresting rules left out,
uninteresting chain counters zeroed):

 - filter chains empty, policies = ACCEPT

 router:~# iptables -t nat -L -n -x -v
 Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
     pkts      bytes target     prot opt in     out     source
destination

 Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
     pkts      bytes target     prot opt in     out     source
destination
     0   0 MASQUERADE  all  --  *      ppp4    0.0.0.0/0
0.0.0.0/0

 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
     pkts      bytes target     prot opt in     out     source
destination


 router:~# iptables -t mangle -L -n -x -v
 Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
     pkts      bytes target     prot opt in     out     source
destination
      0    0 MARK       all  --  eth4   *       192.168.0.22
141.24.12.2/0          MARK set 0x1

 Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
     pkts      bytes target     prot opt in     out     source
destination

 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
     pkts      bytes target     prot opt in     out     source
destination

 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
     pkts      bytes target     prot opt in     out     source
destination

 Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
     pkts      bytes target     prot opt in     out     source
destination

the test:

 i ran a ping on my internal host 192.168.0.22 to a known external host
141.24.12.2.

 iptables shows, that the requests get marked correctly. for testing reasons
added just counting rules also show, that replies are getting in but dont
reach the FORWARD chain. so i assume they get lost while doing the routing.

  router:~# iptables -t mangle -L -n -x -v -Z
  Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
      pkts      bytes target     prot opt in     out     source
destination
         2      120            all  --  ppp4   *       141.24.12.2
0.0.0.0/0
         2      120 MARK       all  --  eth4   *       192.168.0.22
141.24.12.2        MARK set 0x1

  Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
      pkts      bytes target     prot opt in     out     source
destination

  Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
      pkts      bytes target     prot opt in     out     source
destination
         0        0            all  --  ppp4   *       141.24.12.2
0.0.0.0/0

  Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
      pkts      bytes target     prot opt in     out     source
destination

  Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
      pkts      bytes target     prot opt in     out     source
destination
         0        0            all  --  *      eth4    141.24.12.2
0.0.0.0/0

 tcpdump verifies, that indeed replies are coming in and shows, that no icmp
error messages are sent out, what should be the case if no route back could
be found due to incorrect routing.

  router:~# tcpdump -n -i ppp4
  tcpdump: listening on ppp4
  15:06:59.512539 80.144.178.206 > 141.24.12.2: icmp: echo request
  15:06:59.579680 141.24.12.2 > 80.144.178.206: icmp: echo reply (DF)

 changing from "fwmark" usage to the inbuilt filter of iproute the routing
works absolutely fine.

  router:~# ip rule del fwmark 1
  router:~# ip rule add from 192.168.0.22 table test

  <doing some pings from the internal host>

  router:~# iptables -t mangle -L -n -x -v -Z
  Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
      pkts      bytes target     prot opt in     out     source
destination
         4      240            all  --  ppp4   *       141.24.12.2
0.0.0.0/0
         4      240 MARK       all  --  eth4   *       192.168.0.22
141.24.12.2        MARK set 0x1

  Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
      pkts      bytes target     prot opt in     out     source
destination

  Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
      pkts      bytes target     prot opt in     out     source
destination
         4      240            all  --  ppp4   *       141.24.12.2
0.0.0.0/0

  Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
      pkts      bytes target     prot opt in     out     source
destination

  Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
      pkts      bytes target     prot opt in     out     source
destination
         4      500            all  --  *      eth4    141.24.12.2
0.0.0.0/0

router:~# iptables
iptables v1.2.6a: no command specified
Try `iptables -h' or 'iptables --help' for more information.
router:~# ip -V
ip utility, iproute2-ss010824
router:~# cat /proc/version
Linux version 2.4.22 (root@dslrouter) (gcc version 2.95.4 20011002 (Debian
prerelease)) #1 SMP Wed Nov 12 23:08:31 CET 2003


i am grateful for any help. thanks.

thomas hoeppler

Filter out broadcast messages

[Gabby James]

Hi,

I would like to filter out all broadcast messages.  The packets could come 
from 255.255.255.255 or multiple other addresses of the form 10.*.*.255.  
What kind of syntax do I use to DROP these packets?  The line below will 
filter out packets from 255.255.255.255 but I'm not sure what syntax to use 
to DROP the other adresses.

iptables -A INPUT -d 255.255.255.255 -p udp -j DROP

Regards,
GJ

_________________________________________________________________
Worried about inbox overload? Get MSN Extra Storage now!  
http://join.msn.com/?PAGE=features/es

Re: Filter out broadcast messages

[Antony Stone]

On Wednesday 07 January 2004 9:44 pm, Gabby James wrote:

> Hi,
>
> I would like to filter out all broadcast messages.  The packets could come
> from 255.255.255.255 or multiple other addresses of the form 10.*.*.255.
> What kind of syntax do I use to DROP these packets?  The line below will
> filter out packets from 255.255.255.255 but I'm not sure what syntax to use
> to DROP the other adresses.

Should be quite simple really - all you need to know is how many ethernet 
interfaces are on your firewall, and the broadcast address for each (unless 
you've got more than one subnet bound to a single ethernet port, ugh).

Remember that broadcast packets do not get routed, therefore you only ned to 
be concerned with subnets which are local to your firewall.

Unless you have an unusual setup, I'll bet that's no more than three.

It wouldn't be at all hard to script automatically, either.   Start with 
something like:

for a in `/sbin/ifconfig | grep Bcast | tr -s ':' ' ' | cut -d' ' -f6`
do
  iptables -A INPUT -d $a -j DROP
done

Regards,

Antony.

-- 
Anyone that's normal doesn't really achieve much.

 - Mark Blair, Australian rocket engineer

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Filter out broadcast messages

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 312 bytes --]

Le mer 07/01/2004 à 22:44, Gabby James a écrit :

> iptables -A INPUT -d 255.255.255.255 -p udp -j DROP

You can use the addrtype module to filter it :
	http://www.netfilter.org/documentation/pomlist/pom-extra.html#addrtype

BR,
-- 
Eric Leblond
Nufw, Now User Filtering Works (http://www.nufw.org)

[-- Attachment #2: Ceci est une partie de message numériquement signée. --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Filter out broadcast messages

[Antony Stone]

On Wednesday 07 January 2004 9:44 pm, Gabby James wrote:

> Hi,
>
> I would like to filter out all broadcast messages.  The packets could come
> from 255.255.255.255 or multiple other addresses of the form 10.*.*.255.
> What kind of syntax do I use to DROP these packets?  The line below will
> filter out packets from 255.255.255.255 but I'm not sure what syntax to use
> to DROP the other adresses.

Second idea:

If you mean what you say, and the other broadcasts fit the pattern 10.*.*.255, 
you could always use the little-known but perfectly valid netmaslk 
255.0.0.255 in a rule such as:

iptables -I INPUT -s 10.0.0.255/255.0.0.255 -j DROP

This will do exactly what you asked - match packets where the source IP's 
first byte=10 and the last byte=255, with the middle two bytes being 
anything, and drop them.

Antony.

-- 
Perfection in design is achieved not when there is nothing left to add, but 
rather when there is nothing left to take away.

 - Antoine de Saint-Exupery

                                                     Please reply to the list;
                                                           please don't CC me.