Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 4 down vote favorite
1

I'm wondering about this, and I can't seem to find an explanation on the internet. I have a linux gateway which has multiple interfaces:

eth0: external ip
eth1: 172.16.1.1/24
eth2: 172.16.2.1/24
ip_forward is enabled.

IPtables is configured to NAT traffic from eth1 -> eth0 and eth2 -> eth0. But configured not to FORWARD traffic between eth1 <-> eth2.

My question is: Why is it possible for a computer on the 172.16.2.0/24 subnet to ping 172.16.1.1 (ip address of eth1 interface)?

nat

Chain PREROUTING (policy ACCEPT 647K packets, 52M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 17582 packets, 1160K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 14951 packets, 1214K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 187 packets, 42984 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 333K   25M SNAT       all  --  *      eth0    0.0.0.0/0            0.0.0.0/0            to:<external ip>

filter

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  eth1 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    0     0 ACCEPT     tcp  --  eth2 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    0     0 ACCEPT     tcp  --  eth0   *       <some trusted ip>       0.0.0.0/0            tcp dpt:22
    0     0 ACCEPT     udp  --  eth1  *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     udp  --  eth2  *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     icmp --  eth1  *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     icmp --  eth2  *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ULOG       all  --  eth1  eth0    0.0.0.0/0            0.0.0.0/0            state NEW ULOG copy_range 0 nlgroup 1 prefix "NEW: " queue_threshold 1
    0     0 ULOG       all  --  eth2  eth0    0.0.0.0/0            0.0.0.0/0            state NEW ULOG copy_range 0 nlgroup 1 prefix "NEW: " queue_threshold 1
   0 0 ACCEPT     all  --  eth1  eth0    0.0.0.0/0            0.0.0.0/0           
   0 0 ACCEPT     all  --  eth2  eth0    0.0.0.0/0            0.0.0.0/0           
   0 0 ACCEPT     all  --  eth0   eth1   0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
   0 0 ACCEPT     all  --  eth0   eth2   0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
share|improve this question
1  
I think you have to post your firewall config! Which rule have you already created and which default policy? – F. Hauri Jan 12 at 13:51
"Why would it not be possible?" is maybe a better question, or at least, why you think it shouldn't be. – goldilocks Jan 12 at 13:53
Is it only the other router interface the inside legs can ping, or can they ping across the router to machines on the other leg, too? – Warren Young Jan 12 at 14:02
@F.Hauri The default policy for INPUT is DROP, same for FORWARD. There is a rule to allow ping on the eth1 and eth2 interfaces @goldilocks Well, I would think that you were unable to ping the ip address of different interface, because the ip isn't on the same network. @WarrenYoung Yes, iptables drops traffic from eth1 trying to reach eth2. So no pinging ie. 172.16.1.100 from 172.16.2.100. – Daniel.Amkaer Jan 12 at 14:15
Do this host have an default gateway rightly configured? If yes, this is the answer. – F. Hauri Jan 12 at 14:21
show 2 more comments

2 Answers

up vote 5 down vote accepted

My question is: Why is it possible for a computer on the 172.16.2.0/24 subnet to ping 172.16.1.1 (ip address of eth1 interface)?

Because you allowed it, and Linux does it by default.

Linux uses what is called a weak host model. That mean when it receives a packet coming from eth2, it will consider the packet to be for him if the destination address is an IP address of any of its interfaces, not only eth2's. Even if forwarding is disabled.

So that packet enters the PREROUTING hook, the kernel then see that the destination address is its so proceed with the INPUT hook, and you accept all ICMP from eth2, so the packet is accepted.

share|improve this answer
up vote 2 down vote

You may ping 172.16.2.0/24 subnet from/to 172.16.1.1 while your firewall don't include ip based rules and you allow all traffic from both eth1 and eth2 to eth0 (non ip based, including such redirect and back packets)

A good way is to explicitely Drop all packet related to local subnet ip:

iptables -I FORWARD -i eth0 -d 192.168.0.0/16 -j DROP
iptables -I FORWARD -i eth0 -d 172.16.0.0/12 -j DROP
iptables -I FORWARD -i eth0 -d 10.0.0.0/8 -j DROP
iptables -A FORWARD -i eth1 -s 172.16.1.1/24 -o eth0 -j ACCEPT
iptables -A FORWARD -o eth1 -d 172.16.1.1/24 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth2 -s 172.16.2.1/24 -o eth0 -j ACCEPT
iptables -A FORWARD -o eth2 -d 172.16.2.1/24 -i eth0 -j ACCEPT

For sample, where eth2 is linked to your dmz and eth1 to localnet.

with this, you may by able to access 172.16.2.1/24 from 172.16.1.1/24, but not in the other way!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.