iptables forwarding and routing

Question

In fact, this question is about openwrt and CoovaAP, but I guess it's the same in other linux distributions.

I've two interfaces, a "wan" and a "wlan" interface.

Is there by default any filter, which restricts which packets are forwarded from the wlan interface to the wan?

Especially if the wlan interface on the router is 192.168.1.1 and someone connected to this interface enters 172.16.1.1 as IP on his machine. Are his packets then forwarded anyway? Is the routing decision only made up by the destination IP or is it influenced by the source?

I think the problem would be that answers to the 172.16.1.1 machine wouldn't make their way back. Could the iptables forward rules make the interfaces behave like a switch?

If I wanted 172.16.x to be forwarded, I could setup an alias on this physical interface. Is there another way?

The default Coova firewall script just says

iptables -A FORWARD -i $WIFI -o $WAN -j ACCEPT

I disabled masquerading.

Is it possible to "separate" networks in this way and to rely on this? Is there a way someone could make his packets be forwarded with a not-192.168.1.x address?

The reason for this question is, that behind the WAN-interface are machines which should not be reachable for WLAN users. Those machines rely on the source-IP address.

Answer 1

Yes, by default there is a filter: by default no packets are forwarded at all. That's obviously been turned off.

There is a second filter, which may be enabled: the reverse path filter. If enabled, packets coming in an interface have their source address checked against the routing table, to make sure a response would go out the same interface. If not, the packet is dropped. This is configured in /proc/sys/net/ipv4/conf/{all,default,devname}/rp_filter.

Other than those, by default routing is done only based on destination IP.

As to your third question... If you have a machine configured to 172.16.1.1/24, and try to set its default gateway to 192.168.1.1, you'll probably get an error: that default gateway is not reachable (there is no route to it). If you get it to accept and use it anyway (e.g., by adding a route to it), then it'll send the packet to your router. If reverse path filter is turned off, then your router will accept and route the packet. Any replies probably will go nowhere useful:

1. they may not even get back to your router. Other routers know to send packets for 192.168.1.0/24 to your router, but not 172.16.1.0/24. Assuming you set up routes to make that happen, then...

2. your router doesn't know where to send packets for 172.16.1.0/24. Actually—it probably thinks it does, and will send them to the default gateway. If you set up a route on your router to send them back to the box...

3. then it'll probably work.

Alternatives are to just add another IP address to your wlan interface. Its pretty normal for a router to have at least one IP address on each subnet it routes for. You don't need an alias interface to do this, just add a second IP with ip: ip addr add 172.16.1.254/24 dev wlan. Normally on a single-router subnet, the first usable IP is the router, but that's just for convenience; it's not a technical requirement.

iptables apply to all IP traffic flowing through the box. That includes both locally-generated and forwarded traffic.

You can use brctl support to actually bridge wan and wlan (turn them into a switch), but it sounds like you don't want to. You can filter bridges using ebtables (not iptables).