keep-state and divert
Victor Sudakov
sudakov at sibptus.tomsk.ru
Thu Apr 2 21:38:23 PDT 2009
Victor Sudakov wrote:
> If we consider a simple example below, how would you replace the 600th
> rule for a stateful one?
>
> 00100 divert 8668 ip from any to table(1) out via rl0
> 00200 deny log logamount 100 ip from 10.0.0.0/8 to any out via rl0
> 00300 deny log logamount 100 ip from 172.16.0.0/12 to any out via rl0
> 00400 deny log logamount 100 ip from 192.168.0.0/16 to any out via rl0
>
> 00500 divert 8668 ip from table(1) to any in via rl0
> 00600 allow ip from table(1) to any in via rl0
> 00700 deny log logamount 100 ip from any to 10.0.0.0/8 in via rl0
> 00800 deny log logamount 100 ip from any to 172.16.0.0/12 in via rl0
> 00900 deny log logamount 100 ip from any to 192.168.0.0/16 in via rl0
>
> 65535 allow ip from any to any
>
It seems that the ruleset should be reordered and changed to the following:
00100 divert 8668 ip from table(1) to any in via rl0
00200 check-state
00300 deny log logamount 100 ip from any to 10.0.0.0/8 in via rl0
00300 deny log logamount 100 ip from any to 172.16.0.0/12 in via rl0
00300 deny log logamount 100 ip from any to 192.168.0.0/16 in via rl0
00400 skipto 500 ip from any to table(1) out via rl0 keep-state
00500 divert 8668 ip from any to table(1) out via rl0
00600 deny log logamount 100 ip from 10.0.0.0/8 to any out via rl0
00600 deny log logamount 100 ip from 172.16.0.0/12 to any out via rl0
00600 deny log logamount 100 ip from 192.168.0.0/16 to any out via rl0
65535 allow ip from any to any
It seems to work. However there is an obscure moment in it. When I
look at the dynamic rules being created, for each connection I see two
rules: one with the private source address and another with a NAT'ed
source address. Which means the outgoing packet traverses the 400th
rule twice. I don't understand how this happens.
--
Victor Sudakov, VAS4-RIPE, VAS47-RIPN
sip:sudakov at sibptus.tomsk.ru
More information about the freebsd-questions
mailing list