Rule does not work. This is configuration error or bug?

Rule does not work. This is configuration error or bug?

[Bruno Meirelles]

Hi friends,

I have a dns cache on my server listening on port 53 tcp/udp on dual stack.
I'm trying to use the following rule to capture traffic and redirect to 
my server:

nft add rule inet nat PREROUTING iifname "$LAN" meta l4proto {tcp, udp} 
th dport 53 counter redirect to :53 comment Redirect-DNS

In ipv4 traffic, the rule works perfectly. In ipv6 traffic I do not 
receive a response.

in the rule counter, the incoming packet appears:
table inet nat {
         chain PREROUTING {
                 type nat hook prerouting priority dstnat; policy accept;
                 iifname "br0" meta l4proto { tcp, udp } th dport 53 
counter packets 5 bytes 466 redirect to :53 comment "Redirect-DNS"

on nf_conntrack it appears unreplied:
  cat /proc/net/nf_conntrack | grep dport=53

ipv6     10 udp      17 19 src=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 
dst=fd00:ffff:fffe:0100:0000:0000:0000:0001 sport=54959 dport=53 
[UNREPLIED] src=2804:014d:5ca0:82f8:0000:0000:0000:0001              
dst=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 sport=53 dport=54959 mark=0 
zone=0 use=2
ipv6     10 udp      17 18 src=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 
dst=fd00:ffff:fffe:0100:0000:0000:0000:0001 sport=57101 dport=53 
[UNREPLIED] src=2804:014d:5ca0:82f8:0000:0000:0000:0001 
dst=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 sport=53 dport=57101 mark=0 
zone=0 use=2
ipv6     10 udp      17 19 src=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 
dst=fd00:ffff:fffe:0100:0000:0000:0000:0001 sport=49518 dport=53 
[UNREPLIED] src=2804:014d:5ca0:82f8:0000:0000:0000:0001 
dst=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 sport=53 dport=49518 mark=0 
zone=0 use=2

in nf_conntrack, the answer is coming out with the wrong ip, with prefix 
2804. the interface has 2 ips. The 2804 is dynamic, added by dhcpv6 and 
fd00 is static manually configured.

The query is from fd00 to fd00. shouldn't the answer come out with fd00 too?

What did I do wrong? How do I solve this? Can you help me?

Thanks,

Bruno.

Re: Rule does not work. This is configuration error or bug?

[Benno]

l4proto?

Am 24.09.22 um 00:07 schrieb Bruno Meirelles:
> 
> Hi friends,
> 
> […]
> 
> nft add rule inet nat PREROUTING iifname "$LAN" meta l4proto {tcp, udp}
> th dport 53 counter redirect to :53 comment Redirect-DNS
> 
> In ipv4 traffic, the rule works perfectly. In ipv6 traffic I do not
> receive a response.
> 
> […]
> 
> Thanks,
> 
> Bruno.
> 
> 
> 

Re: Rule does not work. This is configuration error or bug?

[Bruno Meirelles]

Hi Benno,

Yes, this is used to match tcp and udp in the same rule.

It is described in the official wiki at the end of this page:
https://wiki.nftables.org/wiki-nftables/index.php/Matching_packet_headers

I tried using dnat and it didn't work either.

nft add rule inet nat PREROUTING iifname "$LAN" meta l4proto {tcp, udp} 
th dport 53 counter dnat ip6 to fd00:ffff:fffe:100::1:53 comment 
Redirect-DNS

nft list ruleset
table inet nat {
         chain PREROUTING {
                 type nat hook prerouting priority dstnat; policy accept;
                 iifname "br0" meta l4proto { tcp, udp } th dport 53 
counter packets 1 bytes 138 dnat ip6 to fd00:ffff:fffe:100::1:53 comment 
"Redirect-DNS"

I tried using ip6tables and it didn't work either. Several people in 
google searches have successfully achieved using ip6tables.

Rules are the same for ipv4 and ipv6, except ipv4 has masquerade. I 
created masquerade for ipv6 and it didn't work either..

All packages are the latest version:

root@router:~# nft --version
nftables v1.0.5 (Lester Gooch #4)

root@router:~# ip6tables --version
ip6tables v1.8.8 (nf_tables)

root@router:~# modinfo nf_conntrack
filename: /lib/modules/5.19.0-1-amd64/kernel/net/netfilter/nf_conntrack.ko
license:        GPL
alias:          nf_conntrack-10
alias:          nf_conntrack-2
alias:          ip_conntrack
depends:        nf_defrag_ipv4,nf_defrag_ipv6,libcrc32c
retpoline:      Y
intree:         Y
name:           nf_conntrack
vermagic:       5.19.0-1-amd64 SMP preempt mod_unload modversions


I really appreciate if anyone can help me.

hugs,

Bruno.


Em 24/09/2022 03:18, Benno escreveu:
> l4proto?
>
> Am 24.09.22 um 00:07 schrieb Bruno Meirelles:
>> Hi friends,
>>
>> […]
>>
>> nft add rule inet nat PREROUTING iifname "$LAN" meta l4proto {tcp, udp}
>> th dport 53 counter redirect to :53 comment Redirect-DNS
>>
>> In ipv4 traffic, the rule works perfectly. In ipv6 traffic I do not
>> receive a response.
>>
>> […]
>>
>> Thanks,
>>
>> Bruno.
>>
>>
>>

Re: Rule does not work. This is configuration error or bug?

[Pablo Neira Ayuso]

Hi,

On Fri, Sep 23, 2022 at 07:07:05PM -0300, Bruno Meirelles wrote:
> 
> Hi friends,
> 
> I have a dns cache on my server listening on port 53 tcp/udp on dual stack.
> I'm trying to use the following rule to capture traffic and redirect to my
> server:
> 
> nft add rule inet nat PREROUTING iifname "$LAN" meta l4proto {tcp, udp} th
> dport 53 counter redirect to :53 comment Redirect-DNS
> 
> In ipv4 traffic, the rule works perfectly. In ipv6 traffic I do not receive
> a response.
> 
> in the rule counter, the incoming packet appears:
> table inet nat {
>         chain PREROUTING {
>                 type nat hook prerouting priority dstnat; policy accept;
>                 iifname "br0" meta l4proto { tcp, udp } th dport 53 counter
> packets 5 bytes 466 redirect to :53 comment "Redirect-DNS"
> 
> on nf_conntrack it appears unreplied:
>  cat /proc/net/nf_conntrack | grep dport=53
> 
> ipv6     10 udp      17 19 src=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513
> dst=fd00:ffff:fffe:0100:0000:0000:0000:0001 sport=54959 dport=53 [UNREPLIED]
> src=2804:014d:5ca0:82f8:0000:0000:0000:0001             
> dst=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 sport=53 dport=54959 mark=0
> zone=0 use=2
> ipv6     10 udp      17 18 src=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513
> dst=fd00:ffff:fffe:0100:0000:0000:0000:0001 sport=57101 dport=53 [UNREPLIED]
> src=2804:014d:5ca0:82f8:0000:0000:0000:0001
> dst=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 sport=53 dport=57101 mark=0
> zone=0 use=2
> ipv6     10 udp      17 19 src=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513
> dst=fd00:ffff:fffe:0100:0000:0000:0000:0001 sport=49518 dport=53 [UNREPLIED]
> src=2804:014d:5ca0:82f8:0000:0000:0000:0001
> dst=fd00:ffff:fffe:0100:c4ce:ad03:0272:3513 sport=53 dport=49518 mark=0
> zone=0 use=2
> 
> in nf_conntrack, the answer is coming out with the wrong ip, with prefix
> 2804. the interface has 2 ips. The 2804 is dynamic, added by dhcpv6 and fd00
> is static manually configured.
> 
> The query is from fd00 to fd00. shouldn't the answer come out with fd00 too?
> 
> What did I do wrong? How do I solve this? Can you help me?

Could you check if packets are being marked as invalid by conntrack?
In such case packets get no conntrack entry attached, in such case NAT
cannot be applied.

Re: Rule does not work. This is configuration error or bug?

[Bruno Meirelles]

Hi Pablo,

Thanks a lot for the help.

I did a test replacing the dns dnscrypt-proxy for bind9 and the rule worked.

I asked on the dnscrypt-proxy forum and nobody knows.

The service is configured to listen on [any] and works without port 
redirection. If I apply the rule stop listening to ipv6. IPv4 works 
perfectly.

Very strange. I will continue bind9 for now. Thanks a lot for the help.

Bruno.

Em 05/10/2022 19:25, Pablo Neira Ayuso escreveu:
> Could you check if packets are being marked as invalid by conntrack?
> In such case packets get no conntrack entry attached, in such case NAT
> cannot be applied.