2

I have a Centos server acting as a NAT in my network. This server has one external (later ext1) interface and three internal (later int1, int2 and int3). Egress traffic comes from users via int1 and after MASQUERADE goes via ext1. Ingress traffic comes from ext1, MASQUERADE, and goes via int2 or int3 according to static routes.

                       | ext1
                       | x.x.x.x/24
             +---------|----------------------+
             |                                |
             |  Centos server  (NAT)          |
             |                                |
             +---|------|---------------|-----+
                 |      |               |
            int1 |      | int2          | int3
   10.30.1.10/24 |      | 10.30.2.10/24 | 10.30.3.10/24
                 ^      v               v
    10.30.1.1/24 |      | 10.30.2.1/24  | 10.30.3.1/24
             +---|------|---------------|-----+
             |   |      |               |     |
             |   |      v               v     |
             |   ^      -Traffic policer-     |
             |   |_____________ |             |
             |                  |             |
             +------------------|-------------+
                                | 192.168.0.1/16
                                |
                                |
                             Clients         
                             192.168.0.0/16

The problem: Egress traffic seems to be dropped after PREROUTING table. Packet counters are not changing on MASQUERADE rule in POSTROUTING. If I change the routes to clients causing the traffic go back via int1 - everything works perfectly.

current iptable configuration is very simple:

# cat /etc/sysconfig/iptables

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-I INPUT 1 -i int1 -j ACCEPT

-A FORWARD -j ACCEPT
COMMIT

*nat
-A POSTROUTING -o ext1 -j MASQUERADE
#
COMMIT

Can anyone point me what I'm missing? Thanks.

UPDATE:

192.168.100.60 via 10.30.2.1 dev int2  proto zebra # routes to clients ...
192.168.100.61 via 10.30.3.1 dev int3  proto zebra # ... I have a lot of them
x.x.x.0/24 dev ext1  proto kernel  scope link  src x.x.x.x 
10.30.1.0/24 dev int1  proto kernel  scope link  src 10.30.1.10 
10.30.2.0/24 dev int2  proto kernel  scope link  src 10.30.2.10 
10.30.3.0/24 dev int3  proto kernel  scope link  src 10.30.3.10 
169.254.0.0/16 dev ext1  scope link  metric 1003 
169.254.0.0/16 dev int1  scope link  metric 1004 
169.254.0.0/16 dev int2  scope link  metric 1005 
169.254.0.0/16 dev int3  scope link  metric 1006 
blackhole 192.168.0.0/16 
default via x.x.x.y dev ext1  

Clients have 192.168.0.1 as gateway, which is redirecting them to 10.30.1.1

6
  • accept input from other internal interfaces or accept estabilished,related connections
    – Alan
    Mar 29, 2012 at 10:51
  • @AlanKuras ACCEPT is firewall default policy in this configuration.
    – Shamanu4
    Mar 29, 2012 at 11:08
  • Youre saying outgoing traffic comes in from clients on the 10.30.1.0/24 subnet, but you want the return traffic to go to the client's IP on the 10.30.2.0/24 (or the .3) subnet? I'm assuming not, so could you provide a few more details on this? Thanks
    – phemmer
    Mar 29, 2012 at 12:02
  • @Patrick 10.30.x.x are only addresses of interfaces. Clients addresses are different, for example from 192.168.0.0/16. The main idea is to send outgoing and ingoing traffic by different routes.
    – Shamanu4
    Mar 29, 2012 at 12:38
  • @AlanKuras. If I'm not misunderstanding you (because I'm very new in iptables) DNAT is using for port forwarding or DMZ.
    – Shamanu4
    Mar 29, 2012 at 12:45

1 Answer 1

8

I suspect you may be running into an issue with the reverse path filter. Which is designed to perform some checks to make sure that the packets received on a given interface actually belong to that interface.

# from linux-doc-nnn/Documentation/networking/ip-sysctl.txt
rp_filter - INTEGER
        0 - No source validation.
        1 - Strict mode as defined in RFC3704 Strict Reverse Path
            Each incoming packet is tested against the FIB and if the interface
            is not the best reverse path the packet check will fail.
            By default failed packets are discarded.
        2 - Loose mode as defined in RFC3704 Loose Reverse Path
            Each incoming packet's source address is also tested against the FIB
            and if the source address is not reachable via any interface
            the packet check will fail.

        Current recommended practice in RFC3704 is to enable strict mode
        to prevent IP spoofing from DDos attacks. If using asymmetric routing
        or other complicated routing, then loose mode is recommended.

        conf/all/rp_filter must also be set to non-zero to do source validation
        on the interface
1
  • Yes, it works! Thanks a lot. I've lost two days reading manuals for iptables with no result...
    – Shamanu4
    Mar 29, 2012 at 17:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .