Re: Stuffed ICMP masquerading

Article View: demon.tech.unix

Article #461

#461

From: Ben Smithurst
Date: Wed, 08 Mar 2000 00:00

31 lines
1929 bytes

Nigel Cole wrote:

> In article <38C61439.52B9920D@oxsemi.com>, Paul Black
> <paul.black@oxsemi.com> writes
>> Nigel Cole <spamtin@zebekia.demon.co.uk> wrote:
>>> If I've read the output correctly, the REJECT was caused by output rule
>>> #3, and the rejected connection was an ICMP "Host unreachable" error.
>>> This rule is:
>>> 
>>> # outgoing from local net on remote interface, stuffed masquerading
>>> ipchains -A output -i $extint -s $intnet -d 0.0.0.0/0 -l -j REJECT
>>> 
>>> ($extint is ppp0, $intnet is 192.168.0.0/24)
>>
>> This rule rejects everything leaving your network.
>
> Surely "rejects everything *that isn't masqueraded* from being allowed
> out"? What I'd like to know is why it wasn't masqueraded.

Maybe it's similar to FreeBSD, I did something like this. In FreeBSD,
the packet's addresses are changed *after* passing through the external
interface (tun0 in FreeBSD, probably ppp0 in Linux). The diagram for BSD
is like:

--- modem --- "ppp -nat" --- tun0 interface --- firewall

so, PPP changes the address before it gets to the modem. Of course, it
may be different in Linux.

-- 
Ben Smithurst / ben@scientia.demon.co.uk / PGP: 0x99392F7D

Technical Details

Message-ID: <slrn8cdo39.288c.ben@strontium.scientia.demon.co.uk>

Path: arc1-ca.pugleaf.net!unknown!not-for-mail

References: <xuWD+XAfrVx4EwkW@zebekia.demon.co.uk> <38C61439.52B9920D@oxsemi.com> <ImHNsjAYftx4EwjF@zebekia.demon.co.uk>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: fac57,e9cef78eb261a0c1
X-Google-Attributes: gidfac57,public
From: ben@scientia.demon.co.uk (Ben Smithurst)
Subject: Re: Stuffed ICMP masquerading
Date: 2000/03/08
Message-ID: <slrn8cdo39.288c.ben@strontium.scientia.demon.co.uk>
X-Deja-AN: 594961223
X-NNTP-Posting-Host: scientia.demon.co.uk:212.228.14.13
References: <xuWD+XAfrVx4EwkW@zebekia.demon.co.uk> <38C61439.52B9920D@oxsemi.com> <ImHNsjAYftx4EwjF@zebekia.demon.co.uk>
X-Complaints-To: abuse@demon.net
X-Trace: news.demon.co.uk 952564477 nnrp-08:8988 NO-IDENT scientia.demon.co.uk:212.228.14.13
User-Agent: slrn/0.9.6.2 (FreeBSD)
NNTP-Posting-Date: 8 Mar 2000 23:21:13 GMT
Newsgroups: demon.tech.unix

Reply to Parent Message