3

Having a root server without iptables rules (I know this is not good, it's just temporary tho in my case), and having configuration like this (for VPN reason):

echo 1 > /proc/sys/net/ipv4/ip_forwarding

iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

Does this include that any host is able to abuse my root server, use it as a router or forward traffic through it in any way?

Improve this question
2
  • Is this a physical or virtual root-server?
    – Nils
    Jun 1, 2013 at 19:55
  • it's physical, most virtual servers don't allow forwarding and nat rules
    – Daniel W.
    Jun 2, 2013 at 22:08

1 Answer 1

Reset to default
1

No. Only hosts on the same (physical or virtual) link can do that. The reason is that you must create a layer 2 (e.g. Ethernet) packet which is aimed at your system but contains an IP target address which is not that of your system.

Hosts which need at least one gateway to reach your system need the help of at least one (maybe all, depending on the circumstances) of these gateways to get this done.

Improve this answer
3
  • root servers are typically physical linked on a switch, are my 'neighbors' able to do bad stuff via mine then? My subnet is 255.255.255.0
    – Daniel W.
    May 31, 2013 at 12:33
  • @DanFromGermany All "neighbours" (net mask doesn' matter, this is layer 2) and all IP tunnel connections (probably none).
    – Hauke Laging
    May 31, 2013 at 12:43
  • Routing back is normally a problem - but forwarding with masquerading will circumvent that. So real trouble in sight here?
    – Nils
    Jun 1, 2013 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .