Board index Linux Networking

Packet Filtering with dynamic IP′s

Packet Filtering with dynamic IP′s

Post by Folker Wend » Sat, 13 Mar 1999 04:00:00



I have my LAN connected to the Internet over a Linux-Gateway using ISDN
(ippp0). Everything works fine with masquerading. Now I want to set up
packetfiltering when the link goes up.

I inserted following lines in the dial-up script, where $INTERFACE means
ippp0:

        # flush and deny everything
        ipfwadm -O -f
        ipfwadm -I -f
        ipfwadm -O -p deny
        ipfwadm -I -p deny

        # my LAN needs full accces to the gateway
        ipfwadm -O -a accept -b -S 0.0.0.0/0 -D  -W eth0
        ipfwadm -I -a accept -b -D 0.0.0.0/0 -S 192.168.42.0/24 -W eth0

        # accept dns
        ipfwadm -O -a accept -P udp -S 0/0 53 1024:65535 -D 0/0 53 -W
$INTERFACE
        ipfwadm -I -a accept -P udp -D 0/0 53 1024:65535 -S 0/0 53 -W
$INTERFACE
        ipfwadm -O -a accept -P tcp -S 0/0 53 1024:65535 -D 0/0 53 -W
$INTERFACE
        ipfwadm -I -a accept -P tcp -D 0/0 53 1024:65535 -S 0/0 53 -k -W
$INTERFACE

        # accept connect from gateway to internet, PORT 113(auth) needed
for Provider Authentication
        ipfwadm -O -a accept -P tcp -S 0/0 1024:65535 -D 0/0 -W
$INTERFACE
        ipfwadm -I -a accept -P tcp -D 0/0 1024:65535 -S 0/0 -k -W
$INTERFACE
        ipfwadm -I -a accept -P tcp -D 0/0 113 -S 0/0  -W $INTERFACE

        # deny, last match
        ipfwadm -I -a deny -o -P tcp -S 0/0 -D 0/0 -W $INTERFACE
        ipfwadm -I -a deny -o -P udp -S 0/0 -D 0/0 -W $INTERFACE

My default Forwarding Rule is:
         ipfwadm -F -a accept -P all -S  192.168.42./24 -D 0/0 -m -W
$INTERFACE

IT DOESNT WORK, and I dont know why. My kernel message when the
connections hangs is as follows:

ipppd[96]:  local IP address 212.7.130.45
ipppd[96]: remote IP address 212.7.128.195
kernel: ip_rewrite_addrs(): shifting saddr from 192.168.0.99 to
212.7.130.45 (state 4)

The LAST LINE appears only with my rules, after a while the connections
goes down and afterwards up again and so on.
What is wrong?

Thanks for your help,
Folker Wendt

 
 
 
Top

Packet Filtering with dynamic IP′s

Post by Leopold Toetsc » Sat, 13 Mar 1999 04:00:00


Hi,
-----Original Message-----

Newsgroups: comp.os.linux.networking
Date: Freitag, 12. M?rz 1999 03:52
Subject: Packet Filtering with dynamic IPs

I have my LAN connected to the Internet over a Linux-Gateway using ISDN
(ippp0). Everything works fine with masquerading. Now I want to set up
packetfiltering when the link goes up.

I inserted following lines in the dial-up script, where $INTERFACE means
ippp0:

        # flush and deny everything
        ipfwadm -O -f
        ipfwadm -I -f
        ipfwadm -O -p deny
        ipfwadm -I -p deny

        # my LAN needs full accces to the gateway
        ipfwadm -O -a accept -b -S 0.0.0.0/0 -D  -W eth0
        ipfwadm -I -a accept -b -D 0.0.0.0/0 -S 192.168.42.0/24 -W eth0
=========SNIP

ipppd[96]:  local IP address 212.7.130.45
ipppd[96]: remote IP address 212.7.128.195
kernel: ip_rewrite_addrs(): shifting saddr from 192.168.0.99 to
212.7.130.45 (state 4)

Your local IP (dynamically set) is now 212.7.130.45, so above Inputrule is
useless. Use Local-IP
You might have a look at my Firewall rules for dynamic IP's at
http://www.toetsch.at/de/tips/linux/99/08.htm
There are also rules against spoofing.
You can download the rules as TXT from the 2. page.

(Also would be nice if some firewalling profis have a look at the rules)

Hope this helps


 
 
 
Top

Packet Filtering with dynamic IP′s

Post by John Hardi » Sat, 13 Mar 1999 04:00:00



> I have my LAN connected to the Internet over a Linux-Gateway using ISDN
> (ippp0). Everything works fine with masquerading. Now I want to set up
> packetfiltering when the link goes up.

Have a look at http://www.wolfenet.com/~jhardin/ipfwadm.html

It's a GUI around ipfwadm, and there are instructions for setting up a
dynamic-IP firewall if you follow the "Invoking the firewall script" link.

--

 pgpk -a finger://gonzo.wolfenet.com/jhardin    PGP key ID: 0x41EA94F5
 PGP key fingerprint: A3 0C 5B C2 EF 0D 2C E5  E9 BF C8 33 A7 A9 CE 76
-----------------------------------------------------------------------
  If you spend any time administering Windows NT, you're far too
  familiar with the Blue Screen of Death (BSOD) ...
                            - "MSDN Flash" email newsletter, 2/9/1999

 
 
 
Top

1. filtering content based on dynamic IP / proxy-firewalls

Hello,

Our company is looking to licence/buy a proxy-firewall server
that can allow specific IP addresses, using the proxy, to access only
specific
URLs. We want to be able to configure what IP addresses can access
which
URLs by simply modifying a file or commandline, and the changes should
take effect immediately. This file or commandline would ideally be in
the
format of : ip has access to URLs, in a table. This configuration
should
also be dynamic because one day user A might be 203.23.4.2 and the
next the
might have a totally different IP. So we want to be able to add or
remove
configuration entries dynamically (this will be done from our
programs)
and have the changes take effect immediately.

For example allowing user (A) with IP: 203.23.4.2 to only access
www.microsoft.com and
www,cisco.com, And the next day the same user A with a different IP
(because it
is dynamically allocated) the same restrictions or possibly different
restrictions
depending on the input from our program into the proxy config.

We cannot perform the configuration through a GUI, because we
are automating the process through a program.

We are preferably looking at a windows solution, but if the UN*X one
is
easier and more efficient we will look to un*x.

Anyone know of a nice solution ?

Thanks for your time,
Mate

2. Re Cyrix 6x86 P166+..some FACTS

3. Packet filtering firewall with IP CHAINS

4. c function mangling in c++

5. Dream of IP Packet Filtering on my Linux Box...

6. star trek vs m$

7. STREAMS and IP packet filtering

8. HACMP and NFS

9. IP packet filter

10. How to filter IP packets

11. IP Masq/Packet filtering with ipchains

12. Filtering packets based on IP/MAC address

13. dynamic IP, first TCP-packet lost


All times are UTC
Board index