Netfilter long forgotten


I was lamenting that I'd forgotten far too much about netfilter/iptables so, to jog my memory, I sat down to put together a quick network in VirtualBox. I setup a router/NAT box with one card bridged to my physical network and two cards in two separate Virtual Host-only networks. To keep things nice and distinct, the networks chosen used were 10.0.0.0/24, 172.16.0.0/16 and 192.168.0.0/24.

The simple routing script is below (with all firewall rules removed for brevity):


#!/bin/bash

WAN=eth1
LAN1=eth2
LAN2=eth3

echo 1 > /proc/sys/net/ipv4/ip_forward

# flush everything to being with
/sbin/iptables -F

# setup NAT via $WAN for the two LANs
/sbin/iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
/sbin/iptables -A FORWARD -i $WAN -o $LAN1 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -i $WAN -o $LAN2 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN1 -o $WAN -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN2 -o $WAN -j ACCEPT

# inter-LAN routing
/sbin/iptables -A FORWARD -i $LAN1 -o $LAN2 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN2 -o $LAN1 -j ACCEPT

# make it a policy to drop any traffic not specifically accepted
/sbin/iptables -P FORWARD DROP




When client2 (192.168.0.31) pings a host in the 10.0.0.0 network... :
root@client2:~# ping 10.0.0.210
PING 10.0.0.210 (10.0.0.210) 56(84) bytes of data.
64 bytes from 10.0.0.210: icmp_req=1 ttl=127 time=0.724 ms
64 bytes from 10.0.0.210: icmp_req=2 ttl=127 time=1.05 ms
 
... IPTraf (running on the router) shows traffic being sent/received (10.0.0.55 is the router):
ICMP echo req (84 bytes) from 192.168.0.31 to 10.0.0.210 on eth3
ICMP echo req (84 bytes) from 10.0.0.55 to 10.0.0.210 on eth1
ICMP echo rply (84 bytes) from 10.0.0.210 to 10.0.0.55 on eth1
ICMP echo rply (84 bytes) from 10.0.0.210 to 192.168.0.31 on eth3




Removing the NAT section from the script and adding lines for eth1 has the effect of just routing between the three networks if NAT is undesirable:
/sbin/iptables -A FORWARD -i $LAN1 -o $WAN -j ACCEPT
/sbin/iptables -A FORWARD -i $WAN -o $LAN1 -j ACCEPT
/sbin/iptables -A FORWARD -i $LAN2 -o $WAN -j ACCEPT
/sbin/iptables -A FORWARD -i $WAN -o $LAN2 -j ACCEPT
 


As an additional exercise, I setup Squid on the router and changed the maximum_object_size to 1048576 KB then had the two clients and then the router do an apt-get upgrade one after the other. This saves re-downloading packages that have recently been picked up by the other client. Even with just the three boxes it's a decent download saver, but on a larger network it would be essential. I'll probably switch this over to something like app-cacher-ng as it's actually designed with this in mind. Below is the connections shown in IPTraf (top), Squid's access log (left) and the result of running apt-get upgrade (right):

Comments

Post a Comment

Popular posts from this blog

Change the ComputerName value in Unattend.xml using PowerShell

A quick and dirty PowerShell script to update the value of ComputerName in Unattend.xml before imaging. This particular value is located at: <unattend>  <settings pass="generalize">   <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">     <computername> Which is a bit of a mouthful, but we can be lazy and just pull the value from the nth component node (in my case it's 3, or the 4th component node). PowerShell uses dots to describe the hierarchical path, which looks a lot neater than the above: $xml.unattend.settings.component[3].computername To repeat, the value of .component[n] will change depending on the structure of the file. The value of the
Read more

Testing out Link Aggregation

Image
I picked up a TP-Link managed switch last week as something of a compromise between affordability and features - as it turns out though, it does just about everything I could ask for, just without the extra expense from buying something that has HP or Cisco written on the side. I grabbed the TL-SG3216, a fanless L2 managed switch with 16x1Gigabit ports as it ticked all the boxes: Silent (fanless) Managed Link Aggregation/802.3ad (LACP) 802.1Q (VLAN) STP As a bonus, the CLI interface (via console cable or ssh) is very similar to Cisco's IOS, so I don't have to learn an entirely new syntax to configure it. Before I replace my existing switch, I spent a bit of time testing out its features. First up, I setup a spare Raspberry Pi with a second ethernet interface (via a USB dongle) to test out link aggregation. First up, the configuration on the Pi (Raspbian): Install ifenslave to allow for the creation of bonded network interfaces # apt-get install ifenslav
Read more

Xbox 360 Exclusive JRPGs on Xbox One

Image
Given it wasn't a big player in Japan (or Asia in general), JRPGs that were only available on the Xbox 360 are quite a rare breed indeed. Even rarer, then, are those that are included in the list of backwards compatible titles for Xbox One. Exclusives The only 3 titles that I know tick both boxes (360 exclusive AND backwards compatible on the Xbox One) are: Blue Dragon Infinite Undiscovery Lost Odyssey Infinite Undiscovery Infinite Undiscovery Lost Odyssey and Blue Dragon enjoy reasonably high profiles, but I have a soft spot for Infinite Undiscovery . It seemed to mainly exist as a test game for the new Star Ocean engine but is an enjoyable fantasy JRPG with a solid cast and good battle system. It also features a New Game+ mode, which bumps up the difficulty. Multi-platform Titles Then there are a few more which are backwards compatible but are available on other platforms: Star Ocean: The Last Hope As an example, Star Ocean: The Last Hope (TLH)
Read more