3

Having a root server without iptables rules (I know this is not good, it's just temporary tho in my case), and having configuration like this (for VPN reason):

echo 1 > /proc/sys/net/ipv4/ip_forwarding

iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

Does this include that any host is able to abuse my root server, use it as a router or forward traffic through it in any way?

2
  • Is this a physical or virtual root-server? – Nils Jun 1 '13 at 19:55
  • it's physical, most virtual servers don't allow forwarding and nat rules – Daniel W. Jun 2 '13 at 22:08
1

No. Only hosts on the same (physical or virtual) link can do that. The reason is that you must create a layer 2 (e.g. Ethernet) packet which is aimed at your system but contains an IP target address which is not that of your system.

Hosts which need at least one gateway to reach your system need the help of at least one (maybe all, depending on the circumstances) of these gateways to get this done.

3
  • root servers are typically physical linked on a switch, are my 'neighbors' able to do bad stuff via mine then? My subnet is 255.255.255.0 – Daniel W. May 31 '13 at 12:33
  • @DanFromGermany All "neighbours" (net mask doesn' matter, this is layer 2) and all IP tunnel connections (probably none). – Hauke Laging May 31 '13 at 12:43
  • Routing back is normally a problem - but forwarding with masquerading will circumvent that. So real trouble in sight here? – Nils Jun 1 '13 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.