How to ignore incoming packets

DISCUSSION Sudheimer 2 participants 6 messages Aug 27, 2003 – Aug 29, 2003

lore

Share & tools

lore

Sudheimer

author

2003-08-27 14:19 UTC #0 lore raw

Hi everyone,

I would like diald to ignore any incoming connection attempts.

For example if I get incoming packages to my tcp port 23 (telnet), they fit the default rule of diald and keep up the line for 2 minutes (keepup tcp 120 any). I do not have telnetd running on this port and have also an ipchains packet denying these packets.

Nevertheless these packages match the final catch-all rule of diald and keep up the line for 2 minutes (keepup tcp 120 any).

On the other hand, I do not want to define a rule like "ignore telnet packets" because this would also match my own telnet-sessions to remote telnet servers.

If it were possible for diald to distinguish between incoming and outgoing packets one could say somthing like "ignore incoming tcp SYN packets". Is there something like that?

Joachim

Mark Frey

2003-08-27 21:36 UTC #1 lore raw

Hi Joachim,

As far as I know, you can only do this if you have a static IP address.
Then you can filter based on your fixed ip.daddr :

ignore tcp ip.daddr=<your fixed ip>,tcp.dest=tcp.telnet

I'd also like to know of any way to accomplish this with a dynamic address!

Mark.

Quoted 27 lines · Sudheimer

Hi everyone,
I would like diald to ignore any incoming connection attempts.
For example if I get incoming packages to my tcp port 23 (telnet), they fit the default rule of diald and keep up the line for 2 minutes (keepup tcp 120 any). I do not have telnetd running on this port and have also an ipchains packet denying these packets.
Nevertheless these packages match the final catch-all rule of diald and keep up the line for 2 minutes (keepup tcp 120 any).
On the other hand, I do not want to define a rule like "ignore telnet packets" because this would also match my own telnet-sessions to remote telnet servers.
If it were possible for diald to distinguish between incoming and outgoing packets one could say somthing like "ignore incoming tcp SYN packets". Is there something like that?
Joachim
-
To unsubscribe from this list: send the line "unsubscribe linux-diald" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Sudheimer

author

2003-08-28 08:19 UTC #2 lore raw

Hi,

thanks for your hint, Mark.

Quoted 7 lines

As far as I know, you can only do this if you have a static IP address.
Then you can filter based on your fixed ip.daddr :
ignore tcp ip.daddr=<your fixed ip>,tcp.dest=tcp.telnet
I'd also like to know of any way to accomplish this with a dynamic address!

It seems to be possible to re-read the config-files with a command to the FIFO:

echo reset > /var/run/diald.fifo

I can do this while watching with dctrl and it seems to work fine (i.e. without changing connection status etc.)

I have not yet tested this with a rules file with changing own IPs, though. I am new to diald and it will probably take me quite some time to find out how to do this (and I am a bit short of time at the moment :-( )

According to man diald
var ip.saddr 12
defines the IP source address of a packet. Maybe one could use something like this on a packet send by the own system once after getting the new own IP. (Can't imagine how, though.)

If not, one might have to find out the own address with ifconfig ... |grep ... after each reconnection and use the result in the rules file.

Maybe somebody more familiar with diald can help or would like to dosome research/testing on this and report to the list...

Jaochim

-------------------------------------------------------------------------

Quoted 24 lines

Quoted 22 lines · Sudheimer
Hi everyone,
I would like diald to ignore any incoming connection attempts.
For example if I get incoming packages to my tcp port 23 (telnet), they fit the default rule of diald and keep up the line for 2 minutes (keepup tcp 120 any). I do not have telnetd running on this port and have also an ipchains packet denying these packets.
Nevertheless these packages match the final catch-all rule of diald and keep up the line for 2 minutes (keepup tcp 120 any).
On the other hand, I do not want to define a rule like "ignore telnet packets" because this would also match my own telnet-sessions to remote telnet servers.
If it were possible for diald to distinguish between incoming and outgoing packets one could say somthing like "ignore incoming tcp SYN packets". Is there something like that?
Joachim

Mark Frey

2003-08-28 11:25 UTC #3 lore raw

Hi Joachim,

Thank you for pointing out the reset command!

Diald passes your ip address to the ip-up script, if defined. You could make a template rule file with a unique pattern everywhere you want your own ip address to be, with lines something like this:

ignore tcp ip.daddr=192.168.255.255,tcp.dest=tcp.telnet

Then in the ip-up script ($3 contains the new local IP address):

cat template_file | sed s/192.168.255.255/$3/g >diald_rule_file echo reset >/var/run/diald.fifo

I'll see if I can find time to try this out here.

Mark.

Quoted 75 lines · Sudheimer

Hi,
thanks for your hint, Mark.
Quoted 7 lines
As far as I know, you can only do this if you have a static IP address.
Then you can filter based on your fixed ip.daddr :
ignore tcp ip.daddr=<your fixed ip>,tcp.dest=tcp.telnet
I'd also like to know of any way to accomplish this with a dynamic address!
It seems to be possible to re-read the config-files with a command to the FIFO:
echo reset > /var/run/diald.fifo
I can do this while watching with dctrl and it seems to work fine (i.e. without changing connection status etc.)
I have not yet tested this with a rules file with changing own IPs, though. I am new to diald and it will probably take me quite some time to find out how to do this (and I am a bit short of time at the moment :-( )
According to man diald
var ip.saddr 12
defines the IP source address of a packet. Maybe one could use something like this on a packet send by the own system once after getting the new own IP. (Can't imagine how, though.)
If not, one might have to find out the own address with ifconfig ... |grep ... after each reconnection and use the result in the rules file.
Maybe somebody more familiar with diald can help or would like to dosome research/testing on this and report to the list...
Jaochim
-------------------------------------------------------------------------
Quoted 18 lines
Quoted 16 lines · Sudheimer
Hi everyone,
I would like diald to ignore any incoming connection attempts.
For example if I get incoming packages to my tcp port 23 (telnet), they fit the default rule of diald and keep up the line for 2 minutes (keepup tcp 120 any). I do not have telnetd running on this port and have also an ipchains packet denying these packets.
Nevertheless these packages match the final catch-all rule of diald and keep up the line for 2 minutes (keepup tcp 120 any).
On the other hand, I do not want to define a rule like "ignore telnet packets" because this would also match my own telnet-sessions to remote telnet servers.
Quoted 6 lines
Quoted 6 lines
If it were possible for diald to distinguish between incoming and outgoing packets one could say somthing like "ignore incoming tcp SYN packets". Is there something like that?
Joachim
-
To unsubscribe from this list: send the line "unsubscribe linux-diald" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Mark Frey

2003-08-28 23:47 UTC #4 lore raw

Hi Joachim,

I've created a new template rule file here and it seems to be working well :-)

All the rules match only on my own dynamic source address, thus ignoring *anything* coming in. If I don't originate packets the link will not be kept up. This assumes the firewall drops everything not associated with an allowed connection and does not generate reject packets.

I might have to add some specific rules if I need for example incoming udp streaming media to keep the link up if the protocol does not generate periodic outgoing packets back to the server...

Here's the bare-bones template file:

# Rule for while offline, proxy address:
accept any 120 ip.saddr=192.168.0.1

# Rules for when we're online:

# Keep up for 29 minutes after last web access accept tcp 1740 ip.saddr=192.168.255.255,tcp.dest=tcp.http accept tcp 1740 ip.saddr=192.168.255.255,tcp.dest=tcp.https

# Keep link up for a while after popping mail accept tcp 900 ip.saddr=192.168.255.255,tcp.dest=tcp.pop3

# Once the link is no longer live, we try to shut down the connection

# quickly. Note that if the link is already down, a state change
# will not bring it back up.
keepup tcp 30 ip.saddr=192.168.255.255,!tcp.live

# 2 minutes for anything else we originate
accept any 120 ip.saddr=192.168.255.255

---------
And, the commands to put in the ip-up script (your file and fifo locations may vary):

# adjust filters for our current ip address:
cat /usr/lib/diald/our.filter.template | sed s/192.168.255.255/$3/g >/usr/lib/diald/our.filter
echo reset > /etc/diald/diald.ctl

Mark.

Quoted 18 lines · Mark Frey

Hi Joachim,
Thank you for pointing out the reset command!
Diald passes your ip address to the ip-up script, if defined. You could make a template rule file with a unique pattern everywhere you want your own ip address to be, with lines something like this:
ignore tcp ip.daddr=192.168.255.255,tcp.dest=tcp.telnet
Then in the ip-up script ($3 contains the new local IP address):
cat template_file | sed s/192.168.255.255/$3/g >diald_rule_file echo reset >/var/run/diald.fifo
I'll see if I can find time to try this out here.
Mark.

[email protected]

author

2003-08-29 16:34 UTC #5 lore raw

Quoted 6 lines · Mark Frey

Hi Joachim,
I've created a new template rule file here and it seems to be working well :-)

Thank's Mark :-))

Joachim