Routing decision?
Hi
In paragraph 6.2 of the iptables-tutorial the following is said:
"The OUTPUT chain is used for altering locally generated packets (i.e., on the firewall) before they get to the routing decision.
But in paragraph 3.1, the "Traversing of tables and chains" diagram, we see the "Routing decision" is listed after the "Local process" and BEFORE! the packet goes to the output chain.
So which one is right? Does the routing decision take place after or before the packet travels through the output chain?
Regards
Signature · 15 lines
Wim Ceulemans R&D Engineer Secure Internet Communication with aXs Guard Able NV Leuvensesteenweg 282 - B-3190 Boortmeerbeek - Belgium Phone: + 32 15 50.44.00 - Fax: + 32 15 50.44.09 E-mail: [email protected] -- Security check on this e-mail has been done by aXs GUARD (http://www.axsguard.com)
Quoted 6 lines · Wim Ceulemans
Hi
In paragraph 6.2 of the iptables-tutorial the following is said:
"The OUTPUT chain is used for altering locally generated packets (i.e., on the firewall) before they get to the routing decision.
Quoted 6 lines
But in paragraph 3.1, the "Traversing of tables and chains" diagram, we see the "Routing decision" is listed after the "Local process" and BEFORE! the packet goes to the output chain.
So which one is right? Does the routing decision take place after or before the packet travels through the output chain?
Are you not getting confused with 'locally generated' and 'local process'. They are not the same thing.
Quoted 2 lines
Regards
Signature · 7 lines
-- Raymond Leach <[email protected]> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --
Hi Ray
In my opinion 'locally generated packets' can only be generated by a local process. So in the diagram where it says 'local process', that's where the 'locally generated packets' start their way through the kernel. Where's the difference?
Regards
Wim
Quoted 23 lines · Ray Leach
Quoted 11 lines · Wim Ceulemans
Hi
In paragraph 6.2 of the iptables-tutorial the following is said:
"The OUTPUT chain is used for altering locally generated packets (i.e., on the firewall) before they get to the routing decision.But in paragraph 3.1, the "Traversing of tables and chains" diagram, we see the "Routing decision" is listed after the "Local process" and BEFORE! the packet goes to the output chain.
So which one is right? Does the routing decision take place after or before the packet travels through the output chain?
Are you not getting confused with 'locally generated' and 'local process'. They are not the same thing.
Quoted 3 lines
Regards
Signature · 15 lines
Wim Ceulemans R&D Engineer Secure Internet Communication with aXs Guard Able NV Leuvensesteenweg 282 - B-3190 Boortmeerbeek - Belgium Phone: + 32 15 50.44.00 - Fax: + 32 15 50.44.09 E-mail: [email protected] -- Security check on this e-mail has been done by aXs GUARD (http://www.axsguard.com)
Quoted 8 lines · Wim Ceulemans
Hi Ray
In my opinion 'locally generated packets' can only be generated by a local process.
So in the diagram where it says 'local process', that's where the 'locally generated packets' start
their way through the kernel. Where's the difference?
What about packets that get SNATed?
Where are they generated?
Quoted 31 lines
Regards
WimQuoted 26 lines · Ray Leach
Quoted 6 lines · Wim Ceulemans
Hi
In paragraph 6.2 of the iptables-tutorial the following is said:
"The OUTPUT chain is used for altering locally generated packets (i.e., on the firewall) before they get to the routing decision.Quoted 8 lines
But in paragraph 3.1, the "Traversing of tables and chains" diagram, we see the "Routing decision" is listed after the "Local process" and BEFORE! the packet goes to the output chain.
So which one is right? Does the routing decision take place after or before the packet travels through the output chain?
Are you not getting confused with 'locally generated' and 'local process'. They are not the same thing.
Quoted 3 lines
Regards
Signature · 7 lines
-- Raymond Leach <[email protected]> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --
Ray
Do you mean that if I masquerade all my packets behind the firewall, that they are considered as locally generated because due to the masquerading their source IP is changed?
This would mean that these packets would travel through the FORWARD chain and then through the OUTPUT chain. And then the 'Kernel packet travelling diagram' would be completely wrong, because packets come only in the OUTPUT chain if they originate from a local process.
Regards
Wim
Quoted 53 lines · Ray Leach
Quoted 8 lines · Wim Ceulemans
Hi Ray
In my opinion 'locally generated packets' can only be generated by a local process. So in the diagram where it says 'local process', that's where the 'locally generated packets' start their way through the kernel. Where's the difference?
What about packets that get SNATed?
Where are they generated?Quoted 37 lines
Regards
WimQuoted 30 lines · Ray Leach
Quoted 13 lines · Wim Ceulemans
Hi
In paragraph 6.2 of the iptables-tutorial the following is said:
"The OUTPUT chain is used for altering locally generated packets (i.e., on the firewall) before they get to the routing decision.But in paragraph 3.1, the "Traversing of tables and chains" diagram, we see the "Routing decision" is listed after the "Local process" and BEFORE! the packet goes to the output chain.
So which one is right? Does the routing decision take place after or before the packet travels through the output chain?
Are you not getting confused with 'locally generated' and 'local process'. They are not the same thing.
Quoted 5 lines
Regards
Signature · 15 lines
Wim Ceulemans R&D Engineer Secure Internet Communication with aXs Guard Able NV Leuvensesteenweg 282 - B-3190 Boortmeerbeek - Belgium Phone: + 32 15 50.44.00 - Fax: + 32 15 50.44.09 E-mail: [email protected] -- Security check on this e-mail has been done by aXs GUARD (http://www.axsguard.com)
Quoted 7 lines · Wim Ceulemans
Ray
Do you mean that if I masquerade all my packets behind the firewall, that they are
considered as locally generated because due to the masquerading their source IP is changed?
Quoted 6 lines
This would mean that these packets would travel through the FORWARD chain and then through
the OUTPUT chain. And then the 'Kernel packet travelling diagram' would be completely wrong,
because packets come only in the OUTPUT chain if they originate from a local process.
No, it was a question ... I don't think they are locally generated.
I think that the aliases on the interface have something to do with it. I have had to add input and output rules in some situations to get DNAT to work the way it is supposed to (redirect to a different destination).
It is strange.
Quoted 64 lines
Regards
WimQuoted 58 lines · Ray Leach
Quoted 10 lines · Wim Ceulemans
Hi Ray
In my opinion 'locally generated packets' can only be generated by a local process.
So in the diagram where it says 'local process', that's where the 'locally generated packets' start
their way through the kernel. Where's the difference?What about packets that get SNATed?
Where are they generated?Quoted 40 lines
Regards
WimQuoted 33 lines · Ray Leach
Quoted 6 lines · Wim Ceulemans
Hi
In paragraph 6.2 of the iptables-tutorial the following is said:
"The OUTPUT chain is used for altering locally generated packets (i.e., on the firewall) before they get to the routing decision.Quoted 10 lines
But in paragraph 3.1, the "Traversing of tables and chains" diagram, we see the "Routing decision" is listed after the "Local process" and BEFORE! the packet goes to the output chain.
So which one is right? Does the routing decision take place after or before the packet travels through the output chain?
Are you not getting confused with 'locally generated' and 'local process'. They are not the same thing.
Quoted 5 lines
Regards
Signature · 7 lines
-- Raymond Leach <[email protected]> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --
Quoted 1 line · Ray Leach
I think that the aliases on the interface have something to do with it.
Nope.
When you DNAT an IP address that does not belong to your DNATing box, there won't be anybody to answer prior router ARP requests on it, unless you either set an alias up or tell this router that the IP as to get routed through the DNATing box.
Quoted 3 lines
I have had to add input and output rules in some situations to get DNAT to work the way it is supposed to (redirect to a different destination). It is strange.
Yes it is. I can get DNAT working without specifying any INPUT or OUTPUT chain. Can you illustrate a situation for which you have to specify INPUT and OUTPUT rules ?
Signature · 2 lines
http://www.netexit.com/~sid/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Quoted 9 lines · Cedric Blancher
Quoted 1 line · Ray Leach
I think that the aliases on the interface have something to do with it.
Nope.
When you DNAT an IP address that does not belong to your DNATing box, there won't be anybody to answer prior router ARP requests on it, unless you either set an alias up or tell this router that the IP as to get routed through the DNATing box.
Quoted 7 lines
Quoted 3 lines
I have had to add input and output rules in some situations to get DNAT to work the way it is supposed to (redirect to a different destination). It is strange.
Yes it is. I can get DNAT working without specifying any INPUT or OUTPUT chain. Can you illustrate a situation for which you have to specify INPUT and OUTPUT rules ?
Sure.
My firewall machine currently has 5 NICs, each with their own ip (one has a public ip - eth0)
eth0 has the public ip. It also has 10 alias ips.
eth1 has a private ip of 192.168.1.1.
eth1 network is my dmz with all the web servers from 192.168.1.165 to 192.168.1.173.
If I want to DNAT incoming traffic destined to on of the aliases bound to interface eth0 to a server in the dmz - eth1 192.168.1.165 (for example), then I need :
- a PREROUTING DNAT rule
- a FORWAORD rule for each direction (eth0 -> eth1 and eth1 -> eth0)
- and an INPUT rule for eth0 alias ip.
Does that make sense?
If I remove the INPUT rule, my DNAT does not work, the packets get sent to the OUTPUT chain ...
Ray
Signature · 7 lines
-- Raymond Leach <[email protected]> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --
Quoted 5 lines · Ray Leach
My firewall machine currently has 5 NICs, each with their own ip (one has a public ip - eth0)
eth0 has the public ip. It also has 10 alias ips.
eth1 has a private ip of 192.168.1.1.
eth1 network is my dmz with all the web servers from 192.168.1.165 to
Quoted 8 lines
192.168.1.173.
If I want to DNAT incoming traffic destined to on of the aliases bound to interface eth0 to a server in the dmz - eth1 192.168.1.165 (for example), then I need :
- a PREROUTING DNAT rule
- a FORWAORD rule for each direction (eth0 -> eth1 and eth1 -> eth0)
- and an INPUT rule for eth0 alias ip.
Does that make sense?
Not to me. Supposing alias i set up (using iproute or ifconfig) I would do this (and I think you did this) :
iptables -t nat -A PREROUTING -d $ALIAS -i eth0 -j DNAT \ --to 192.168.1.165 iptables -A FORWARD -d 192.168.1.165 -i eth0 -o eth1 -j ACCEPT iptables -A FORWARD -s 192.168.1.165 -i eth1 -o eth0 -j ACCEPT
And that's all to set a DNAT for incoming packets.
Quoted 2 lines
If I remove the INPUT rule, my DNAT does not work, the packets get sent to the OUTPUT chain ...
What is the INPUT rule ? Once your packet gets DNATed in PREROUTING, it is not sent to NF_IP_LOCAL_IN, but to NF_IP_FORWARD. Thus, it does not cross filter table INPUT chain. If packets go through INPUT chain, that means they're still destined to the alias IP, so that the DNAT rule did not match them.
And I do not see how packets could go to OUTPUT chain as they're supposed to get routed, not locally generated... The only case I see is REDIRECT target use on a local proxy, so packets go through INPUT, then proxy reply sent through OUTPUT chain.
I'm a bit lost on this one.
Signature · 2 lines
http://www.netexit.com/~sid/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Quoted 28 lines · Cedric Blancher
Quoted 5 lines · Ray Leach
My firewall machine currently has 5 NICs, each with their own ip (one has a public ip - eth0)
eth0 has the public ip. It also has 10 alias ips.
eth1 has a private ip of 192.168.1.1.
eth1 network is my dmz with all the web servers from 192.168.1.165 toQuoted 8 lines
192.168.1.173.
If I want to DNAT incoming traffic destined to on of the aliases bound to interface eth0 to a server in the dmz - eth1 192.168.1.165 (for example), then I need :
- a PREROUTING DNAT rule
- a FORWAORD rule for each direction (eth0 -> eth1 and eth1 -> eth0)
- and an INPUT rule for eth0 alias ip.
Does that make sense?Not to me. Supposing alias i set up (using iproute or ifconfig) I would do this (and I think you did this) :
iptables -t nat -A PREROUTING -d $ALIAS -i eth0 -j DNAT \ --to 192.168.1.165 iptables -A FORWARD -d 192.168.1.165 -i eth0 -o eth1 -j ACCEPT iptables -A FORWARD -s 192.168.1.165 -i eth1 -o eth0 -j ACCEPTAnd that's all to set a DNAT for incoming packets.
Quoted 2 lines
If I remove the INPUT rule, my DNAT does not work, the packets get sent to the OUTPUT chain ...
Quoted 9 lines
What is the INPUT rule ? Once your packet gets DNATed in PREROUTING, it is not sent to
NF_IP_LOCAL_IN, but toNF_IP_FORWARD. Thus, it does not cross filter table INPUT chain. If packets go through INPUT chain, that means they're still destined to the alias IP, so that the DNAT rule did not match them.
And I do not see how packets could go to OUTPUT chain as they're supposed to get routed, not locally generated... The only case I see is REDIRECT target use on a local proxy, so packets go through INPUT, then proxy reply sent through OUTPUT chain.
Now that's a possibility! I didn't even think of that. I do have a transparent squid proxy running on that machine.
I suppose I was watching the traffic going through the proxy (probably because I was testing from a local machine).
Thanks
Quoted 2 lines
I'm a bit lost on this one.
Signature · 7 lines
-- Raymond Leach <[email protected]> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --