* Egress filters
@ 2011-01-26 10:39 Martin Mares
2011-01-26 11:18 ` Marek Kierdelewicz
0 siblings, 1 reply; 6+ messages in thread
From: Martin Mares @ 2011-01-26 10:39 UTC (permalink / raw)
To: netfilter
Hello, world!\n
I would like to set up an egress filter, which would process all outgoing
packets just before they hit the network interface (especially after all
NATing takes place).
Is there any table/chain for that?
Have a nice fortnight
--
Martin `MJ' Mares <mj@ucw.cz> http://mj.ucw.cz/
Faculty of Math and Physics, Charles University, Prague, Czech Rep., Earth
int random(void) { return 4; /* Random number chosen by a fair dice roll. */ }
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Egress filters
2011-01-26 10:39 Egress filters Martin Mares
@ 2011-01-26 11:18 ` Marek Kierdelewicz
2011-01-26 11:43 ` Martin Mares
0 siblings, 1 reply; 6+ messages in thread
From: Marek Kierdelewicz @ 2011-01-26 11:18 UTC (permalink / raw)
To: Martin Mares; +Cc: netfilter
>Hello, world!\n
Hi,
>I would like to set up an egress filter, which would process all
>outgoing packets just before they hit the network interface (especially
>after all NATing takes place).
>Is there any table/chain for that?
Look here:
http://jengelh.medozas.de/images/nf-packet-flow.png
Mangle table postrouting chain is an appropriate place. Filtering would
take place before nat table postrouting chain (nat table is consulted
only for the first packet of the flow).
best regards,
Marek Kierdelewicz
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Egress filters
2011-01-26 11:18 ` Marek Kierdelewicz
@ 2011-01-26 11:43 ` Martin Mares
2011-01-26 12:35 ` Marek Kierdelewicz
2011-01-26 12:37 ` Marek Kierdelewicz
0 siblings, 2 replies; 6+ messages in thread
From: Martin Mares @ 2011-01-26 11:43 UTC (permalink / raw)
To: Marek Kierdelewicz; +Cc: netfilter
Hi!
> Mangle table postrouting chain is an appropriate place. Filtering would
> take place before nat table postrouting chain (nat table is consulted
> only for the first packet of the flow).
I know that, but I want to hook my rules _after_ the nat table postrouting
chain. (I want to catch packets with private source address which are not
NATed due to misconfiguration of my complex NAT setup.)
Have a nice fortnight
--
Martin `MJ' Mares <mj@ucw.cz> http://mj.ucw.cz/
Faculty of Math and Physics, Charles University, Prague, Czech Rep., Earth
"Oh no, not again!" -- The bowl of petunias
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Egress filters
2011-01-26 11:43 ` Martin Mares
@ 2011-01-26 12:35 ` Marek Kierdelewicz
2011-01-26 12:38 ` Martin Mares
2011-01-26 12:37 ` Marek Kierdelewicz
1 sibling, 1 reply; 6+ messages in thread
From: Marek Kierdelewicz @ 2011-01-26 12:35 UTC (permalink / raw)
To: Martin Mares; +Cc: netfilter
Hi,
>I know that, but I want to hook my rules _after_ the nat table
>postrouting chain. (I want to catch packets with private source address
>which are not NATed due to misconfiguration of my complex NAT setup.)
Some time ago you could simply add DROP at the end of nat postrouting
chain, but this option is off the table.
You can add rule connmarking traffic to 0x10 at the end of nat
postrouting chain and drop everything with that connmark in filter
forward chain. First packet of the filtered flows would get trough but
everything would be axed.
Best regards,
Marek Kierdelewicz
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Egress filters
2011-01-26 11:43 ` Martin Mares
2011-01-26 12:35 ` Marek Kierdelewicz
@ 2011-01-26 12:37 ` Marek Kierdelewicz
1 sibling, 0 replies; 6+ messages in thread
From: Marek Kierdelewicz @ 2011-01-26 12:37 UTC (permalink / raw)
To: Martin Mares; +Cc: netfilter
>First packet of the filtered flows would get trough but
>everything would be axed.
First packet of the filtered flows would get trough but
everything ELSE would be axed.
Best regards,
Marek Kierdelewicz
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Egress filters
2011-01-26 12:35 ` Marek Kierdelewicz
@ 2011-01-26 12:38 ` Martin Mares
0 siblings, 0 replies; 6+ messages in thread
From: Martin Mares @ 2011-01-26 12:38 UTC (permalink / raw)
To: Marek Kierdelewicz; +Cc: netfilter
Hi!
> You can add rule connmarking traffic to 0x10 at the end of nat
> postrouting chain and drop everything with that connmark in filter
> forward chain. First packet of the filtered flows would get trough but
> everything would be axed.
That's a neat trick, but still I believe there should be a simple way
how to do egress filtering.
Would a patch adding a POSTROUTING chain to the raw table, positioned
after all other chains, be welcome?
Have a nice fortnight
--
Martin `MJ' Mares <mj@ucw.cz> http://mj.ucw.cz/
Faculty of Math and Physics, Charles University, Prague, Czech Rep., Earth
"Please try to fit your code to 80 columns. That's decimal 80." -- A. Morton
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-01-26 12:38 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-01-26 10:39 Egress filters Martin Mares
2011-01-26 11:18 ` Marek Kierdelewicz
2011-01-26 11:43 ` Martin Mares
2011-01-26 12:35 ` Marek Kierdelewicz
2011-01-26 12:38 ` Martin Mares
2011-01-26 12:37 ` Marek Kierdelewicz
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.