* Blocking in NAT
@ 2011-05-07 13:20 James Lay
2011-05-07 14:54 ` Jan Engelhardt
0 siblings, 1 reply; 5+ messages in thread
From: James Lay @ 2011-05-07 13:20 UTC (permalink / raw)
To: Netfilter
Hey All,
Soäonce upon a time one could block using NAT, which was nice since I run
a spamfilter that grabs everything coming in to port 25 with:
iptables -t nat -A PREROUTING -m physdev --physdev-in eth0 ! -s 10.0.0.0/8
-p tcp --dport 25 -j DNAT --to-destination 10.0.0.1:25
For some reason, filtering in the nat table was deemed bad, so now I can
no longer drop things there. So my question is, how do I block say...a
spammer from sending to port 25 now? I can't use:
iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
-j DROP
or
iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
-j REJECT
Am I going to have to do something silly like send to an ip that's not on
my network:
iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
-j DNAT --to-destiation 172.16.1.1
I have to admit...loosing the DROP functionality in nat was a real
bummer....I had a great script that would block ANYTHING from an IP
address with the INPUT, FORWARD, and PREROUTING tables..not so much now
though ;) Thanks for any input you can provide.
James
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Blocking in NAT
2011-05-07 13:20 Blocking in NAT James Lay
@ 2011-05-07 14:54 ` Jan Engelhardt
2011-05-09 8:54 ` Nikolay Kichukov
0 siblings, 1 reply; 5+ messages in thread
From: Jan Engelhardt @ 2011-05-07 14:54 UTC (permalink / raw)
To: James Lay; +Cc: Netfilter
On Saturday 2011-05-07 15:20, James Lay wrote:
>Hey All,
>
>So?once upon a time one could block using NAT, which was nice since I run
>a spamfilter that grabs everything coming in to port 25 with:
>
>iptables -t nat -A PREROUTING -m physdev --physdev-in eth0 ! -s 10.0.0.0/8
>-p tcp --dport 25 -j DNAT --to-destination 10.0.0.1:25
>
>For some reason, filtering in the nat table was deemed bad, so now I can
>no longer drop things there. So my question is, how do I block say...a
>spammer from sending to port 25 now? I can't use:
>
>iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
>-j DROP
>or
>iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
>-j REJECT
iptables -A INPUT (or FORWARD, depending on use case) -m physdev
--physdev-in eth0 -s naughty.ip (-p tcp --dport 25) -j REJECT
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Blocking in NAT
2011-05-07 14:54 ` Jan Engelhardt
@ 2011-05-09 8:54 ` Nikolay Kichukov
2011-05-09 9:39 ` Jan Engelhardt
0 siblings, 1 reply; 5+ messages in thread
From: Nikolay Kichukov @ 2011-05-09 8:54 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: James Lay, Netfilter
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
or just block it in the -t mangle -A PREROUTING table.
Have a look at the packet flow diagram and you will be good to go!
Cheers,
- -Nik
On 05/07/2011 05:54 PM, Jan Engelhardt wrote:
> On Saturday 2011-05-07 15:20, James Lay wrote:
>
>> Hey All,
>>
>> So?once upon a time one could block using NAT, which was nice since I run
>> a spamfilter that grabs everything coming in to port 25 with:
>>
>> iptables -t nat -A PREROUTING -m physdev --physdev-in eth0 ! -s 10.0.0.0/8
>> -p tcp --dport 25 -j DNAT --to-destination 10.0.0.1:25
>>
>> For some reason, filtering in the nat table was deemed bad, so now I can
>> no longer drop things there. So my question is, how do I block say...a
>> spammer from sending to port 25 now? I can't use:
>>
>> iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
>> -j DROP
>> or
>> iptables -t nat -i PREROUTING -m physdev --physdev-in eth0 -s naughty.ip
>> -j REJECT
>
>
> iptables -A INPUT (or FORWARD, depending on use case) -m physdev
> --physdev-in eth0 -s naughty.ip (-p tcp --dport 25) -j REJECT
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQEcBAEBAgAGBQJNx6vAAAoJEDFLYVOGGjgXS30H/RmE9stI4q8nWbZ03ObdIJ5H
gMQiZ2EST/Rz6q/OL37bGdk5bkZcRhj72AqRkrxB57lZDDpsk8uEwIlhoW61J3uI
dFXrGRZAPtCOd4yrGoILKBuK0hLOr/qWHGhxyCXw+Oa4Boq1LUjQHmJSRynss7Ui
caSjV9AWq4f6hmY3tLTQd8pXsi5zTOGKHSYwlRuoPeiUIiHZc9QkFAA6BOMw3Pl5
2NjjpOYAiRwt7/qbCWHaQkqsxvv3JD3tO/RT+Mg41cuOnuLj5945h7IktkbxVKj7
p7xvWJtUHDyD01A+rhb7B3lUn95eM3Hv3nBsAhnbcsXMQl/TO23/2jnsGuvxcbs=
=Hqow
-----END PGP SIGNATURE-----
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Blocking in NAT
2011-05-09 8:54 ` Nikolay Kichukov
@ 2011-05-09 9:39 ` Jan Engelhardt
0 siblings, 0 replies; 5+ messages in thread
From: Jan Engelhardt @ 2011-05-09 9:39 UTC (permalink / raw)
To: Nikolay Kichukov; +Cc: James Lay, Netfilter
On Monday 2011-05-09 10:54, Nikolay Kichukov wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Hi,
>
>or just block it in the -t mangle -A PREROUTING table.
>Have a look at the packet flow diagram and you will be good to go!
Well, there is a reason the table is called "filter".
^ permalink raw reply [flat|nested] 5+ messages in thread
* Blocking in NAT
@ 2011-05-08 16:09 James Lay
0 siblings, 0 replies; 5+ messages in thread
From: James Lay @ 2011-05-08 16:09 UTC (permalink / raw)
To: Netfilter
Bleh...nuked the email before I could respond....thanks Jan...the input
chain did the trick.
James
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2011-05-09 9:39 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-05-07 13:20 Blocking in NAT James Lay
2011-05-07 14:54 ` Jan Engelhardt
2011-05-09 8:54 ` Nikolay Kichukov
2011-05-09 9:39 ` Jan Engelhardt
2011-05-08 16:09 James Lay
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.