keep-state and divert

Victor Sudakov sudakov at sibptus.tomsk.ru
Thu Apr 2 21:38:23 PDT 2009


Victor Sudakov wrote:
> If we consider a simple example below, how would you replace the 600th
> rule for a stateful one?
> 
> 00100 divert 8668 ip from any to table(1) out via rl0
> 00200 deny log logamount 100 ip from 10.0.0.0/8 to any out via rl0
> 00300 deny log logamount 100 ip from 172.16.0.0/12 to any out via rl0
> 00400 deny log logamount 100 ip from 192.168.0.0/16 to any out via rl0
> 
> 00500 divert 8668 ip from table(1) to any in via rl0
> 00600 allow ip from table(1) to any in via rl0
> 00700 deny log logamount 100 ip from any to 10.0.0.0/8 in via rl0
> 00800 deny log logamount 100 ip from any to 172.16.0.0/12 in via rl0
> 00900 deny log logamount 100 ip from any to 192.168.0.0/16 in via rl0
> 
> 65535 allow ip from any to any
> 

It seems that the ruleset should be reordered and changed to the following:

00100 divert 8668 ip from table(1) to any in via rl0
00200 check-state
00300 deny log logamount 100 ip from any to 10.0.0.0/8 in via rl0
00300 deny log logamount 100 ip from any to 172.16.0.0/12 in via rl0
00300 deny log logamount 100 ip from any to 192.168.0.0/16 in via rl0

00400 skipto 500 ip from any to table(1) out via rl0 keep-state
00500 divert 8668 ip from any to table(1) out via rl0
00600 deny log logamount 100 ip from 10.0.0.0/8 to any out via rl0
00600 deny log logamount 100 ip from 172.16.0.0/12 to any out via rl0
00600 deny log logamount 100 ip from 192.168.0.0/16 to any out via rl0

65535 allow ip from any to any

It seems to work. However there is an obscure moment in it. When I
look at the dynamic rules being created, for each connection I see two
rules: one with the private source address and another with a NAT'ed
source address. Which means the outgoing packet traverses the 400th
rule twice.  I don't understand how this happens.

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
sip:sudakov at sibptus.tomsk.ru


More information about the freebsd-questions mailing list