From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Gerry Weaver" Subject: iptables bridge filter question Date: Thu, 18 Mar 2004 02:28:28 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01C40C90.B2BBE9E0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_000E_01C40C90.B2BBE9E0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Hello All, I have setup a bridging firewall. I want to drop packets on the external interface, which have source addresses on my internal network. However, the firewall/bridge sits between my T1 router and the rest of my LAN. Is there a way to drop the packets mentioned previously, but allow the router? I guess a rule could be created that uses the routers mac address as a match. I've been playing around with this, but I'm not getting the result I want. I could sure use some advice on this. [ LAN xx.xx.xx.0/24 ]<==>[ bridge/firewall ]<==>[ router xx.xx.xx.254/24 ] Thanks in advance, Gerry --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.576 / Virus Database: 365 - Release Date: 1/30/2004 ------=_NextPart_000_000E_01C40C90.B2BBE9E0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hello=20 All,

I have = setup a=20 bridging firewall. I want to drop packets on the external interface, = which have=20 source addresses on my internal network. However, the firewall/bridge = sits=20 between my T1 router and the rest of my LAN. Is there a way to drop the = packets=20 mentioned previously, but allow the router? I guess a rule could be = created that=20 uses the routers mac address as a match. I've been playing around with = this, but=20 I'm not getting the result I want. I could sure use some advice on=20 this.

[ LAN = xx.xx.xx.0/24=20 ]<=3D=3D>[ bridge/firewall ]<=3D=3D>[ router xx.xx.xx.254/24 = ]

Thanks = in=20 advance,

Gerry

------=_NextPart_000_000E_01C40C90.B2BBE9E0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Steve Jones" Subject: RE: iptables bridge filter question Date: Thu, 18 Mar 2004 10:02:46 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <79C037414A4B604CA73F5222570C6DFC800F@e2k3.ftdata.com> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C40CFA.12CC48E1" Return-path: Content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Gerry Weaver , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------_=_NextPart_001_01C40CFA.12CC48E1 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I don't think I'm entirely clear about what you are trying to block, but I *THINK* I just went through the learning curve to do a similar thing myself, and was successful. Check out ebtables.sourceforge.net. My requirement was to put a transparent bridge between a router and a switch, to block or allow CERTAIN traffic based on source and/or destination IP addresses. My particular scenario would have been more appropriately handled by standard iptables, except for that I don't control the network configuration, so I couldn't change any IP addresses. =20 Basically, I downloaded the latest ebtables user space utilities, and the kernel source for 2.6.4, compiled it on my fresh RH9 box, then compiled the ebtables tools. Ebtables then gave me the ability to filter packets at layer two, while bridging. I'm not at the site today where the firewall is, but I'm going to be VPNing in later to get the small scripts I used. Let me know if you want me to send them as an example. =20 -Steve =20 ________________________________ From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Gerry Weaver Sent: Thursday, March 18, 2004 3:28 AM To: netfilter@lists.netfilter.org Subject: iptables bridge filter question =20 Hello All, =20 I have setup a bridging firewall. I want to drop packets on the external interface, which have source addresses on my internal network. However, the firewall/bridge sits between my T1 router and the rest of my LAN. Is there a way to drop the packets mentioned previously, but allow the router? I guess a rule could be created that uses the routers mac address as a match. I've been playing around with this, but I'm not getting the result I want. I could sure use some advice on this. =20 [ LAN xx.xx.xx.0/24 ]<=3D=3D>[ bridge/firewall ]<=3D=3D>[ router = xx.xx.xx.254/24 ] =20 =20 Thanks in advance, Gerry ------_=_NextPart_001_01C40CFA.12CC48E1 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I don’t think I’m = entirely clear about what you are trying to block, but I *THINK* I just went through the learning curve to do a = similar thing myself, and was successful. = Check out ebtables.sourceforge.net. = My requirement was to put a transparent bridge between a router and a = switch, to block or allow CERTAIN traffic based on source and/or destination IP = addresses. My particular scenario would = have been more appropriately handled by standard iptables, except for that I = don’t control the network configuration, so I couldn’t change any IP = addresses.

Basically, I downloaded the latest ebtables user space utilities, and the kernel source for 2.6.4, compiled = it on my fresh RH9 box, then compiled the ebtables tools. Ebtables then gave = me the ability to filter packets at layer two, while = bridging.

I’m not at the site today where the firewall is, but I’m = going to be VPNing in later to get the small scripts I used. Let me know if you want me to = send them as an example.

-Steve

From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Gerry Weaver
Sent: Thursday, March 18, = 2004 3:28 AM
To: = netfilter@lists.netfilter.org
Subject: iptables bridge = filter question

Hello All,

I have setup a bridging firewall. I want to drop = packets on the external interface, which have source addresses on my internal = network. However, the firewall/bridge sits between my T1 router and the rest of = my LAN. Is there a way to drop the packets mentioned previously, but allow the = router? I guess a rule could be created that uses the routers mac address as a = match. I've been playing around with this, but I'm not getting the result I = want. I could sure use some advice on this.

[ LAN xx.xx.xx.0/24 ]<=3D=3D>[ bridge/firewall ]<=3D=3D>[ router xx.xx.xx.254/24 ]

Thanks in advance,

Gerry

------_=_NextPart_001_01C40CFA.12CC48E1-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: iptables bridge filter question Date: Thu, 18 Mar 2004 15:24:35 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200403181524.35795.Antony@Soft-Solutions.co.uk> References: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Thursday 18 March 2004 8:28 am, Gerry Weaver wrote: > Hello All, > > I have setup a bridging firewall. I want to drop packets on the external > interface, which have source addresses on my internal network. However, the > firewall/bridge sits between my T1 router and the rest of my LAN. Is there > a way to drop the packets mentioned previously, but allow the router? I > guess a rule could be created that uses the routers mac address as a match. > I've been playing around with this, but I'm not getting the result I want. > I could sure use some advice on this. > > [ LAN xx.xx.xx.0/24 ]<==>[ bridge/firewall ]<==>[ router xx.xx.xx.254/24 ] How about: iptables -A FORWARD -i $extIF -s xx.xx.xx.254 -j ACCEPT iptables -A FORWARD -i $extIF -s xx.xx.xx.0/24 -j DROP ? Antony. -- Most people have more than the average number of legs. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: iptables bridge filter question Date: Thu, 18 Mar 2004 15:33:58 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200403181533.58166.Antony@Soft-Solutions.co.uk> References: <200403181524.35795.Antony@Soft-Solutions.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <200403181524.35795.Antony@Soft-Solutions.co.uk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Thursday 18 March 2004 3:24 pm, Antony Stone wrote: > On Thursday 18 March 2004 8:28 am, Gerry Weaver wrote: > > Hello All, > > > > I have setup a bridging firewall. I want to drop packets on the external > > interface, which have source addresses on my internal network. However, > > the firewall/bridge sits between my T1 router and the rest of my LAN. Is > > there a way to drop the packets mentioned previously, but allow the > > router? I guess a rule could be created that uses the routers mac address > > as a match. I've been playing around with this, but I'm not getting the > > result I want. I could sure use some advice on this. > > > > [ LAN xx.xx.xx.0/24 ]<==>[ bridge/firewall ]<==>[ router xx.xx.xx.254/24 > > ] > > How about: > > iptables -A FORWARD -i $extIF -s xx.xx.xx.254 -j ACCEPT > iptables -A FORWARD -i $extIF -s xx.xx.xx.0/24 -j DROP Okay, scrub that - I overlooked the significance of it being a *bridging* firewall :( Antony. -- All matter in the Universe can be placed into one of two categories: 1. Things which need to be fixed. 2. Things which need to be fixed once you've had a few minutes to play with them. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Gerry Weaver" Subject: RE: iptables bridge filter question Date: Thu, 18 Mar 2004 14:12:53 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Hi, Firstly, thanks for the suggestions. Please let me explain further. I want to setup an anti-spoofing rule that will block packets coming in on the external interface, which have a source address of my internal net. The problem is that I have a router that sits in the external side of the bridge. I need to stop spoofed packets while still allowing my router. Shouldn't the following allow my router by mac address and then drop everything else that's coming in with a source address of my internal net? EXTERNAL_IFACE="eth0" INTERNAL_NET="10.10.10.0/24" ROUTER_MAC="00:00:00:00:00:00" iptables -N tcp_packets iptables -N udp_packets iptables -A INPUT -p tcp -i $EXTERNAL_IFACE -j tcp_packets iptables -A INPUT -p udp -i $EXTERNAL_IFACE -j udp_packets iptables -A tcp_packets -i eth0 -m mac --mac-source $ROUTER_MAC -j ACCEPT iptables -A tcp_packets -p tcp -j DROP -s $INTERNAL_NET -j DROP iptables -A udp_packets -i eth0 -m mac --mac-source $ROUTER_MAC -j ACCEPT iptables -A udp_packets -p udp -j DROP -s $INTERNAL_NET -j DROP Thanks, Gerry [Gerry Weaver] -----Original Message----- From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Gerry Weaver Sent: Thursday, March 18, 2004 2:28 AM To: netfilter@lists.netfilter.org Subject: iptables bridge filter question Hello All, I have setup a bridging firewall. I want to drop packets on the external interface, which have source addresses on my internal network. However, the firewall/bridge sits between my T1 router and the rest of my LAN. Is there a way to drop the packets mentioned previously, but allow the router? I guess a rule could be created that uses the routers mac address as a match. I've been playing around with this, but I'm not getting the result I want. I could sure use some advice on this. [ LAN xx.xx.xx.0/24 ]<==>[ bridge/firewall ]<==>[ router xx.xx.xx.254/24 ] Thanks in advance, Gerry --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.576 / Virus Database: 365 - Release Date: 1/30/2004 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: iptables bridge filter question Date: Thu, 18 Mar 2004 20:40:03 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200403182040.03659.Antony@Soft-Solutions.co.uk> References: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Thursday 18 March 2004 8:12 pm, Gerry Weaver wrote: > Hi, > > Firstly, thanks for the suggestions. Please let me explain further. I want > to setup an anti-spoofing rule that will block packets coming in on the > external interface, which have a source address of my internal net. The > problem is that I have a router that sits in the external side of the > bridge. I need to stop spoofed packets while still allowing my router. Question: Why are you expecting to see packets coming from your router which have the source address of the router's internal interface? I agree that any packets *originating* from the router (including replies to any packets you send to it) will have this address, but are you really expecting such traffic? Most of the packets you see coming from your router will have source addresses out on the Internet (that, after all, is what the router is for), so it may be that you don't have the "unique address" problem after all? Regards, Antony. -- The first fifty percent of an engineering project takes ninety percent of the time, and the remaining fifty percent takes another ninety percent of the time. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Gerry Weaver" Subject: RE: iptables bridge filter question Date: Thu, 18 Mar 2004 17:09:32 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: References: <200403182040.03659.Antony@Soft-Solutions.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200403182040.03659.Antony@Soft-Solutions.co.uk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Antony Stone Cc: netfilter@lists.netfilter.org Hi, I understand what your suggesting. Perhaps I still didn't explain well enough. Here's an example: [NodeA 10.10.10.1]<==>[Firewall 10.10.10.2]<==>[Router 10.10.10.254] If the router is setup as the default gateway for NodeA then wouldn't it be sending packets with a source address on the 10.10.10.0 network through the external interface of the bridge. If I created a rule which dropped any packets that arrived at the external Firewall interface, with a source address on the 10.10.10.0 network, would that be a problem? I'm not saying your wrong. I'm just trying to understand my misunderstanding. Thanks, Gerry -----Original Message----- From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Antony Stone Sent: Thursday, March 18, 2004 2:40 PM To: netfilter@lists.netfilter.org Subject: Re: iptables bridge filter question On Thursday 18 March 2004 8:12 pm, Gerry Weaver wrote: > Hi, > > Firstly, thanks for the suggestions. Please let me explain further. I want > to setup an anti-spoofing rule that will block packets coming in on the > external interface, which have a source address of my internal net. The > problem is that I have a router that sits in the external side of the > bridge. I need to stop spoofed packets while still allowing my router. Question: Why are you expecting to see packets coming from your router which have the source address of the router's internal interface? I agree that any packets *originating* from the router (including replies to any packets you send to it) will have this address, but are you really expecting such traffic? Most of the packets you see coming from your router will have source addresses out on the Internet (that, after all, is what the router is for), so it may be that you don't have the "unique address" problem after all? Regards, Antony. -- The first fifty percent of an engineering project takes ninety percent of the time, and the remaining fifty percent takes another ninety percent of the time. Please reply to the list; please don't CC me. --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.576 / Virus Database: 365 - Release Date: 1/30/2004 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.576 / Virus Database: 365 - Release Date: 1/30/2004 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: iptables bridge filter question Date: Thu, 18 Mar 2004 23:16:47 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200403182316.47015.Antony@Soft-Solutions.co.uk> References: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Netfilter Mailing List On Thursday 18 March 2004 11:09 pm, Gerry Weaver wrote: > Hi, > > I understand what your suggesting. Perhaps I still didn't explain well > enough. Here's an example: > > [NodeA 10.10.10.1]<==>[Firewall 10.10.10.2]<==>[Router 10.10.10.254] > > If the router is setup as the default gateway for NodeA then wouldn't it be > sending packets with a source address on the 10.10.10.0 network through the > external interface of the bridge. No, I don't think so. I assume three things here (please let me know if I'm wrong): 1. The router IS performing source nat on outbound packets (so that packets which end up on the Internet have a public routable source address rather than something within 10.10.10.0/24). 2. The router is NOT performing source nat on inbound packets coming from the Internet (so that packets arriving on your local network have the correct source address of the machine they came from, out in the Big Wide World). 3. You have no great interest in talking to your router from local network machines - they want to talk to the Rest Of The World, which is on the other side of the router. Now, if all the above assumptions are true, then valid packets arriving at your network through the router from the Internet will have the source addresses of the machines they came from, not the internal address of the router. If, for some rather obscure reason, your router is performing source nat on incoming packets, then yes, they will have 10.10.10.254 as their source address, but I really can't think why this would be the case. Regards, Antony. -- One good tern deserves another. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vincent Haverlant Subject: Re: iptables bridge filter question Date: Thu, 18 Mar 2004 20:28:50 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20040318192850.GD21027@haverlant.org> References: <200403181524.35795.Antony@Soft-Solutions.co.uk> <200403181533.58166.Antony@Soft-Solutions.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-Disposition: inline In-Reply-To: <200403181533.58166.Antony@Soft-Solutions.co.uk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: Antony Stone Cc: netfilter@lists.netfilter.org Le Thu Mar 18 15:33:58 2004, Antony Stone a =E9crit: | > > I have setup a bridging firewall. I want to drop packets on the ext= ernal | > > interface, which have source addresses on my internal network. Howe= ver, | > > the firewall/bridge sits between my T1 router and the rest of my LA= N. Is | > > there a way to drop the packets mentioned previously, but allow the | > > router? I guess a rule could be created that uses the routers mac a= ddress | > > as a match. I've been playing around with this, but I'm not getting= the | > > result I want. I could sure use some advice on this. | > > | > > [ LAN xx.xx.xx.0/24 ]<=3D=3D>[ bridge/firewall ]<=3D=3D>[ router xx= .xx.xx.254/24 | > > ] | > | > How about: | > | > iptables -A FORWARD -i $extIF -s xx.xx.xx.254 -j ACCEPT | > iptables -A FORWARD -i $extIF -s xx.xx.xx.0/24 -j DROP |=20 | Okay, scrub that - I overlooked the significance of it being a *bridgin= g*=20 | firewall :( Well this is not altogether stupid :) provided you have the bridge-nf patch for a 2.4 kernel or a 2.6 kernel with bridge filtering and ebtables. Vincent. --=20 .~. Vincent Haverlant -- Galadril -- #ICQ: 35695155 =20 /V\ MSN: vincent_msn@haverlant.org -- http://www.haverlant.org/ /( )\ Parinux member: http://www.parinux.org/ ^^-^^ GPG: 8FEA 52C2 5C54 A201 2375 0FA5 AF2E 1881 92D0 EE84