| View previous topic :: View next topic |
| Author |
Message |
regavoga
n00b
Joined: 24 May 2005
Posts: 16
|
 Posted: Mon Mar 27, 2006 9:09 am Post subject: Routing based on destination ports? [Solved] |
 |
|
Hi!
On my school network, our admin have blocked all ports but 80 and 443. Therefore, we've set up this Gentoo router, and a VPN tunnel to another machine outside the firewall. This VPN tunnel works fine, but is it possible to forward all packets with destination ports 80 or 443 to device eth0 (our school network) and all the others (22 - ssh, as an example) to device tun0 (the tunnel)?
How could this be done?
Thanx,
Ole Martin Handeland
Last edited by regavoga on Mon Mar 27, 2006 2:44 pm; edited 1 time in total |
|
| Back to top |
|
 |
ASID
Apprentice
Joined: 22 Mar 2006
Posts: 195
|
| Posted: Mon Mar 27, 2006 9:28 am Post subject: |
|
|
| Quote: | | is it possible to forward all packets with destination ports 80 or 443 to device eth0 (our school network) and all the others (22 - ssh, as an example) to device tun0 (the tunnel)? |
Yep! It's called firewall 
Take a look at this manual http://www.linuxsecurity.com/resource_files/firewalls/IPTables-Tutorial/iptables-tutorial.html as a start to the iptables.
What you need to do is build a rule that checks the --source-port and if it finds a match to forward it to the correct --out-interface.
If you need more help, just ask  |
|
| Back to top |
|
|
regavoga
n00b
Joined: 24 May 2005
Posts: 16
|
| Posted: Mon Mar 27, 2006 9:33 am Post subject: |
|
|
thanx!
but in which table and chain should i have this in?
my current setup:
iptables -t nat -L -v
| Code: |
Chain PREROUTING (policy ACCEPT 142K packets, 24M bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 337 packets, 24595 bytes)
pkts bytes target prot opt in out source destination
443 26636 MASQUERADE all -- any eth0 anywhere anywhere
Chain OUTPUT (policy ACCEPT 834 packets, 55643 bytes)
pkts bytes target prot opt in out source destination
|
iptables -L -v
| Code: |
Chain INPUT (policy ACCEPT 106K packets, 36M bytes)
pkts bytes target prot opt in out source destination
9 772 ACCEPT all -- lo any anywhere anywhere
90582 6843K ACCEPT all -- eth1 any anywhere anywhere
3167 1089K REJECT udp -- !eth1 any anywhere anywhere udp dpt:bootps reject-with icmp-port-unreachable
0 0 REJECT udp -- !eth1 any anywhere anywhere udp dpt:domain reject-with icmp-port-unreachable
Chain FORWARD (policy DROP 257 packets, 20550 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- eth1 any anywhere 192.168.1.0/24
517K 104M ACCEPT all -- eth1 any 192.168.1.0/24 anywhere
3673 2677K ACCEPT all -- eth0 any anywhere 192.168.1.0/24
Chain OUTPUT (policy ACCEPT 114K packets, 29M bytes)
pkts bytes target prot opt in out source destination
|
i followed this guide: http://www.gentoo.org/doc/en/home-router-howto.xml
edit: and you are shure i don't have to edit my routes? |
|
| Back to top |
|
|
ASID
Apprentice
Joined: 22 Mar 2006
Posts: 195
|
| Posted: Mon Mar 27, 2006 11:07 am Post subject: |
|
|
I'm not sure if I understand correct your topology but I think that you want something like:
| Code: | | iptables -t nat -A PREROUTING --dport 80,443 -j DNAT --to-destination $eth0_IP |
This will forward packets that have as destination ports 80 and 443 to the ip of the eth0. |
|
| Back to top |
|
|
regavoga
n00b
Joined: 24 May 2005
Posts: 16
|
| Posted: Mon Mar 27, 2006 11:27 am Post subject: |
|
|
wouldn't that change the packets destination adress to (in this case) eth0s address? that wouldn't work, because you've change the destination of the packet, and it will never reach its goal?
update: i added this (the first rule) to the postrouting chain in the nat table:
| Code: | Chain POSTROUTING (policy ACCEPT 340 packets, 24843 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- any tun0 anywhere anywhere
1335 80465 MASQUERADE all -- any eth0 anywhere anywhere
|
so, now i thought all my forwarded packets should pass through the tun0 interface... but it doesn't? does this have something to do with my kernel routing table? |
|
| Back to top |
|
|
ASID
Apprentice
Joined: 22 Mar 2006
Posts: 195
|
| Posted: Mon Mar 27, 2006 12:29 pm Post subject: |
|
|
Isn't that what you want?
Can you please give me more information about the topology of your network. Your box has two network cards and three interfaces? Is it behind the school network with real IPs or NATed? |
|
| Back to top |
|
|
salam
Apprentice
Joined: 29 Sep 2005
Posts: 227
|
| Posted: Mon Mar 27, 2006 1:45 pm Post subject: |
|
|
i assume you use the gentoo server where the vpn is as a gateway for your boxes
i think there is no 'common' way to do port based routing
you can do
iptables
iptables -t mangle -A PREROUTING -i $inner_iface -j MARK --set-mark 2
iptables -t mangle -A PREROUTING -i $inner_iface -p tcp -m multiport --dports 80,443 -j MARK --set-mark 1
so all packets will be marked as 2 and 80+443 as 1
and then use iproute2 to do a mark-based routing
i think you'll also have to NAT your outgoing connections on the gentoo box |
|
| Back to top |
|
|
ASID
Apprentice
Joined: 22 Mar 2006
Posts: 195
|
| Posted: Mon Mar 27, 2006 2:08 pm Post subject: |
|
|
| Quote: | | i assume you use the gentoo server where the vpn is as a gateway for your boxes |
Oh, if that's the case then salam is right. You should mark the packets and then redirect them to the correct routing table.
You should first create the table:
| Code: | | echo 1 MYTABLE >> /etc/iproute2/rt_tables |
Set the mark:
| Code: | | iptables -A PREROUTING -t mangle -i eth0 -p tcp --dprot 80 -j MARK --set-mark 1 |
Make the ruting rules:
| Code: | | ip route add default via x.x.x.x dev eth0 table MYTABLE |
where x.x.x.x is the default gateway you want your packets to follow.
Finally make the rule that will check the MARK.
| Code: | | ip rule add from all fwmark 1 table MYTABLE |
I hope that helps |
|
| Back to top |
|
|
regavoga
n00b
Joined: 24 May 2005
Posts: 16
|
| Posted: Mon Mar 27, 2006 2:19 pm Post subject: |
|
|
thanx alot!!
i actually looked at mark/iproute2, but never worked it out.. sadly, (irony) school is over for today... i will try again tomorrow! (and come back here and whine if it doesn't work  )
also found this guide: http://www.karnaugh.za.net/show?id=194 |
|
| Back to top |
|
|
Mroofka
Guru
Joined: 25 Jan 2005
Posts: 369
Location: Poland
|
| Posted: Mon Mar 27, 2006 2:28 pm Post subject: |
|
|
| Quote: | | think you'll also have to NAT your outgoing connections on the gentoo box |
salam could you explain that... I've problem with setting up load-balanicng for my box (I don't have any nated computers) the connections were send with bad src ip eg. packet was send with src ip 192.168.200.10 throug eth0 but should go throu eth1. and only way to make it working was
| Code: | -A POSTROUTING -s 192.168.200.10 -o eth0 -j SNAT --to-source 80.48.56.70
-A POSTROUTING -s 80.48.56.70 -o eth1 -j SNAT --to-source 192.168.200.10
|
but for me it's quit wierd eaven stupid and a I thing that is some routing problem.
the whole problem is here 
https://forums.gentoo.org/viewtopic-t-447016.html
Pozdrawiam
_________________
"Make install not love"
registred linux User # 379143
"Ready for Anything; Prepared for everything; Surprised by Nothing !" |
|
| Back to top |
|
|
salam
Apprentice
Joined: 29 Sep 2005
Posts: 227
|
| Posted: Mon Mar 27, 2006 2:52 pm Post subject: |
|
|
from your link i see that (if i am correct) you want to do a load balancing for one box with 2 net adapters
the problem is that this will probably not work for mark based routing at output. because when parsing output chain, the -o device is already decided so you cannot route via another.iface
when you want to use multiple adapters as gateways for differnent traffic, you'll have probably to use iptables route target (patch-o-matic part) |
|
| Back to top |
|
|
Mroofka
Guru
Joined: 25 Jan 2005
Posts: 369
Location: Poland
|
| Posted: Mon Mar 27, 2006 3:04 pm Post subject: |
|
|
ok it's one problem thanks for tip. Have you read my secund post from "my" topic. I wrote it few minutes ago and there is another problem 
I'm going to look at patch-o-matic but it only let me cheat my system but not resolve this problem in right way :p
Pozdrawiam
_________________
"Make install not love"
registred linux User # 379143
"Ready for Anything; Prepared for everything; Surprised by Nothing !" |
|
| Back to top |
|
|
|
Networking & Security
