limit multicast to wanted outout interfaces using iptables (or other lartc commands)

Question

I have the unifi server running for all my access points on a network. The controller host sits on a few networks, but only one of them should be used by unifi. Of course, the server has no options to control which interfaces it uses. And it's spilling multicast onto the wrong networks.

I tried just blocking all non-whitelisted multicast like so:

iptables -A OUTPUT -d 224.0.0.0/4 -j DROP

That seems like a no brainer to me, and it works, except that eventually the unifi controller goes into a loop (with no sleep() in it apparently) and keeps trying to stuff the socket for interfaces I don't want it talking on — thank you strace for this revelation. So the server was sitting at 100% CPU, just because of a -j DROP rule in iptables. Neat.

I'm looking for a way to discard the packets without blocking (ie, so unifi thinks the packets went out) or to redirect them to acceptable interfaces. Even if it's sourced poorly, it's better than letting it spill onto the wrong networks.

And to that end, I also tried to mangle and route them to loopback, but the packets went out the wrong interface, ignoring the routes. I figure they open sockets on the interfaces directly or something.

 iptables -t mangle -A PREROUTING -d 224.0.0.0/4 -j MARK --set-mark 666
 ip rule add fwmark 666 table 666
 ip route add 224.0.0.0/4 dev lo table 666

I'm using the route table and the fw marks to make sure I don't null route any wanted multicasts (whitelisted elsewhere).

I think unifi bypasses the routing table alltogether. The set-mark was firing (HUGE packet counts), but the packets continued to go out the unwanted interfaces. Similar rules for other multicasts seem to work fine. It's something horrible unifi is doing (raw ip socket maybe?).

It's really not an important issue. I've simply moved the services to a different vm that only has one interface; but I'd like to know how I could do this for academic reasons. It seems like there should be a way to limit applications to interfaces you want them to be limited to.

Answer 1

One way to do this would be to use unshare -n to put the process into its own network namespace. This will effectively constrain the interfaces it can bind to such that it will only ever send out the interfaces exported over the namespace.

This is equivalent to putting it on a VM with only one interface but 'cheaper' in the sense it doesn't require the additional VM overheads.

You may also want to try putting your PREROUTING rule into the OUTPUT chain since these packets are generated locally (I assume) on the host. The routing is merely bypassed because netfilter does not analyze packets sourced locally in the PREROUTING chain.

Also some iptables rules specifying the interface you permit and multicast through would be useful.

iptables -o ethX -d 224.0.0.0/4 -j DROP

Would help ensure packets really do go out on the networks you care about.