0

I have been using iptables to block all unknown mac addresses from the internet gateway by

EXT_DEV=wlan0
INT_DEV=eth0
INT_NET=192.168.0.0/20
modprobe ip_conntrack
modprobe ip_conntrack_ftp
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
conntrack -F
iptables -P INPUT   DROP
iptables -P OUTPUT  DROP
iptables -P FORWARD DROP
MACS=("${MACS[@]}" "00:00:00:00:00:00");   # known mac addresses
MACS=("${MACS[@]}" "11:11:11:11:11:11");   # and many more...
for MAC in ${MACS[@]}; 
do 
    iptables -A INPUT -m mac --mac-source $MAC -j ACCEPT
    iptables -A FORWARD -m mac --mac-source $MAC -j ACCEPT
done
##################################################################
# and here follows the lines that seem not to do as I would expect
iptables -A PREROUTING -t mangle -i $INT_DEV -p tcp --dport 80 -j MARK --set-mark 99
iptables -A PREROUTING -t mangle -m mark --mark 99 -j TRACE
iptables -t nat -A PREROUTING -m mark --mark 99 -p tcp --dport 80 -j DNAT --to-destination 192.168.0.30
iptables -t filter -A FORWARD -m mark --mark 99 -j DROP
# upto here are the troubled lines 
##################################################################
iptables -A OUTPUT -o $INT_DEV -s $INT_NET -d $INT_NET -j ACCEPT
iptables -A OUTPUT  -o $EXT_DEV -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o $EXT_DEV -s $INT_NET -j MASQUERADE
iptables -A INPUT   -i $EXT_DEV -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i $EXT_DEV -m state --state RELATED,ESTABLISHED -j ACCEPT

Now when I try to print the packages using:
xtables-monitor --trace | grep "MARK=0x63" | grep "SRC=192.168.0.134" It shows me all those marked packages (I assume mark 99 shows up as MARK=0x63) as:

PACKET: 0 36288a1d IN=eth0 OUT=eth0 MACSRC=AA:AA:AA:AA:AA:AA MACDST=BB:BB:BB:BB:BB:BB MACPROTO=0800 SRC=192.168.0.134 DST=192.168.0.30 LEN=60 TOS=0x0 TTL=63 ID=12174DF SPORT=54228 DPORT=80 SYN MARK=0x63
and many more...

However the browser of my testbox of 192.168.0.134 does not get served with the content of 192.168.0.30 but instead times out with "connection timed out"

What is causing the redirect not to work here..?
And what can I do to troubleshoot this to find out what I'n doing wrong here?

0

1 Answer 1

1

When you do a hairpin redirect, you need to change not only the destination address, but also the source address. Because if not, the target server will try to reply directly to the source, while the source never have a record of trying to contact the target server.

You need to add a rule with -j SNAT, I think in the POSTROUTING chain of the nat table.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .