1

I am using older SOHO router wl500gP (it is v1 but I think this is not important) with custom Oleg firmware. My topology looks like this:

   192.168.3.3       192.168.3.2       NAT       192.168.2.1           192.168.2.170 (DHCP)
PC1<--------------------------->(WAN)wl500gP(LAN)<-------------------------------->PC2

According to web interface I have NAT enabled on my router (bellow are some outputs you that you can verify it, since with custom firmware the router is Linux box).

Now my discovery: I can access LAN interface of my router from PC1, but I cannot access PC2 from PC1. I am not sure if accessing (even part of) internal network from outside world is normal NAT behavior. Shouldn't be all the addresses which are translated hidden behind NAT? As I am aware I have not set virtual servers, port forwarding, DMZs etc. Here are my experiments:

# PC1:

└──> ping 192.168.2.1
connect: Network is unreachable

└──> sudo route add -net 192.168.2.0 netmask 255.255.255.0 dev eth0

└──> ping 192.168.2.1
PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data.
64 bytes from 192.168.2.1: icmp_req=1 ttl=64 time=0.873 ms
64 bytes from 192.168.2.1: icmp_req=2 ttl=64 time=0.405 ms
64 bytes from 192.168.2.1: icmp_req=3 ttl=64 time=0.415 ms
64 bytes from 192.168.2.1: icmp_req=4 ttl=64 time=0.399 ms
^C
--- 192.168.2.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 2998ms
rtt min/avg/max/mdev = 0.399/0.523/0.873/0.202 ms

└──> ping 192.168.2.170
PING 192.168.2.170 (192.168.2.170) 56(84) bytes of data.
From 192.168.3.3 icmp_seq=1 Destination Host Unreachable
From 192.168.3.3 icmp_seq=2 Destination Host Unreachable
From 192.168.3.3 icmp_seq=3 Destination Host Unreachable
From 192.168.3.3 icmp_seq=4 Destination Host Unreachable
From 192.168.3.3 icmp_seq=5 Destination Host Unreachable
From 192.168.3.3 icmp_seq=6 Destination Host Unreachable


# PC2:
# Both pings to 192.168.3.2 and 192.168.3.3 are working. Also simple communication with 192.168.3.3 using netcat is possible.

Here is also a quiet complex list of (I hope) most important outputs from my router. Those are mainly default values (I've changed IP addresses and some other stuff but I hope nothing related to NAT, routing, bridging, forwarding etc. that could cause the mentioned NAT behavior) If somebody will explain the IP Tables and IP Tables NAT section I will be thankful. What I noticed is that dnsmasq daemon is running so it looks like NAT DNS is active.

wl500gP:


Interfaces
##########

br0       Link encap:Ethernet  HWaddr 00:1B:FC:6B:81:02  
          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:203 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:77202 (75.3 KiB)

eth0      Link encap:Ethernet  HWaddr 00:1B:FC:6B:81:02  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2561 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3101 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:264691 (258.4 KiB)  TX bytes:2594967 (2.4 MiB)
          Interrupt:4 Base address:0x1000 

eth1      Link encap:Ethernet  HWaddr 00:1B:FC:6B:81:02  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:14
          TX packets:203 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:78826 (76.9 KiB)
          Interrupt:12 Base address:0x2000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING MULTICAST  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

vlan0     Link encap:Ethernet  HWaddr 00:1B:FC:6B:81:02  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:203 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:78014 (76.1 KiB)

vlan1     Link encap:Ethernet  HWaddr 00:1B:FC:6B:81:02  
          inet addr:192.168.3.2  Bcast:192.168.3.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2561 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2898 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:218593 (213.4 KiB)  TX bytes:2516953 (2.3 MiB)



Routing Table
#############

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.3.3     0.0.0.0         255.255.255.255 UH    0      0        0 vlan1
192.168.3.0     0.0.0.0         255.255.255.0   U     0      0        0 vlan1
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         192.168.3.3     0.0.0.0         UG    0      0        0 vlan1


IP Tables
#########

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
 2366  197K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           state NEW 
  170 63047 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           state NEW 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21 flags:0x17/0x02 
  188 11280 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.2.1         tcp dpt:80 
    4   336 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:33434:33534 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           state INVALID 
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 DROP       all  --  !br0   vlan1   0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           ctstate DNAT 
    0     0 DROP       all  --  *      br0     0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 3069 packets, 2528K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain BRUTE (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain MACS (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain SECURITY (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 limit: avg 1/sec burst 5 
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x04 limit: avg 1/sec burst 5 
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 5/sec burst 5 
    0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 5/sec burst 5 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain logaccept (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW LOG flags 7 level 4 prefix `ACCEPT ' 
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain logdrop (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW LOG flags 7 level 4 prefix `DROP ' 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           


IP Tables NAT
#############

Chain PREROUTING (policy ACCEPT 4 packets, 336 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  189 11340 VSERVER    all  --  *      *       0.0.0.0/0            192.168.3.2         

Chain POSTROUTING (policy ACCEPT 13 packets, 4303 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  all  --  *      vlan1  !192.168.3.2          0.0.0.0/0           
    0     0 MASQUERADE  all  --  *      br0     192.168.2.0/24       192.168.2.0/24      

Chain OUTPUT (policy ACCEPT 13 packets, 4303 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain VSERVER (1 references)
 pkts bytes target     prot opt in     out     source               destination         
  189 11340 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:8080 to:192.168.2.1:80 



Process List
############

  PID USER       VSZ STAT COMMAND
    1 admin     1484 S    /sbin/init
    2 admin        0 SW   [keventd]
    3 admin        0 SWN  [ksoftirqd_CPU0]
    4 admin        0 SW   [kswapd]
    5 admin        0 SW   [bdflush]
    6 admin        0 SW   [kupdated]
    7 admin        0 SW   [mtdblockd]
   54 admin     1484 S    syslogd -m 0 -O /tmp/syslog.log -S -D -l 7 -b 1
   58 admin     1480 S    klogd
   59 admin     1480 S    telnetd
   64 admin     1120 S    httpd vlan1
   70 nobody     852 S    dnsmasq
   73 admin      964 S    lld2d br0 eth1
   74 admin        0 SW   [khubd]
   83 admin      656 S    p9100d -f /dev/usb/lp0 0
   85 admin     1480 S    rcamdmain
   99 admin     1480 S    watchdog
  101 admin     1040 S    upnp -D -L br0 -W vlan1
  150 admin     1484 S    sh -c /tmp/../usr/sbin/sysinfo > /tmp/sysinfo.htm
  151 admin     1480 S    /bin/sh /tmp/../usr/sbin/sysinfo
  167 admin     1480 R    ps




brctl show
##########

bridge name bridge id       STP enabled interfaces
br0     8000.001bfc6b8102   no      vlan0
                            eth1
4

That's normal, and has nothing to do with NAT. Linux, by default, treats IP addresses as belonging to the machine¹, not to a particular interface. So it'll answer packets to 192.168.2.1 on any interface, not just the LAN interface.

That said, NAT does not imply a firewall, or vice versa. You can, for example, map internal hosts 192.168.0.2–254 to public IPs X.Y.Z.2–254, and have all traffic heading to X.Y.Z.253 be forwarded to 192.168.0.253. That's still NAT.

With mapping an entire subnet to one external IP address, as a side effect you get firewall-like behavior, making connections basically outgoing-only. But even so, your firewall rules should still block those packets—the NAT code can probably be tricked to map a port you don't want it to, the firewall won't. And its more flexible, too. (And if your ISP gets compromised, they could send you traffic to your private LAN addresses, and your machine would happily forward it).

PS: To see the NAT rules, you want iptables -t nat -L. To see what is allowed to forward through your router/firewall, you need to look at the FORWARD chain, not the INPUT chain.


Footnotes
¹ Or more precisely, a particular network namespace on the machine—there is likely only one unless you're using certain virtual server techniques. The arp_ignore and arp_announce files in /proc/net/ipv4/conf/*/ configure this behavior.

  • Thank you for reply. "Linux, by default, treats IP addresses as belonging to the machine". Does this mean that other OSes treats them different (especially Windows)? Is't this security issue since as an attacker I can find the IP of the inner network interface which is most probably the gateway for clients on inner network. "With mapping an entire subnet to one external IP address, as a side effect you get firewall-like behavior." is there any reason why this mapping causes firewall-like behavior as a side effect? I mean why in this case the local interface is not accessible from outer net? – Wakan Tanka Apr 1 '15 at 14:11
  • Just for my curiosity: is there a way that Linux will treat IP as belonging to interface not as to machine (I mean except mentioned firewall)? I suppose that would require some kernel hacking. – Wakan Tanka Apr 1 '15 at 14:18
  • @WakanTanka Not sure how Windows does it (don't have any multi-NIC Windows machines to test). It's not that big of a security concern, as it'd have to be an attack by your ISP—someone on the same Ethernet link, that traffic won't get through a router. (And really the security of your LAN shouldn't depend on its subnet being secret, and there are a lot of ways that subnet will leak out.) Finally, look at the footnote—you can change those files in /proc to change the behavior. – derobert Apr 1 '15 at 16:25
  • "With mapping an entire subnet to one external IP address, as a side effect you get firewall-like behavior, making connections basically outgoing-only" NO, Iptables NAT is connection based, so it will hapilly NAT outgoing connections while allowing incoming ones to pass unmolested. – plugwash Dec 2 '16 at 4:19
  • So if you only have a NAT rule (no firewall rules) and an attacker can get a packet to your box with the right destination IP (e.g. they control a box that is on-link with your external interface) then they can talk to machines on your internal network. – plugwash Dec 2 '16 at 4:20
0

There are a few things to note.

  1. Iptables NAT is connection based. Broadly speaking (there are some complications surrounding protecols like ftp which have NAT helpers) only the first packet of a connection goes through the NAT tables, that then determines how the rest of the connection will be treated.
  2. NAT does not imply firewalling or vice-versa. If you only had a NAT rule in place you would be perfectly able to ping all your internal hosts.
  3. Packets only flow through the FORWARD chain if they are actually being forwarded. If they are destined for an address on the local machine they go to the INPUT chain instead.

The rules in your INPUT chain accept all ICMP packets, so the ping to the router's "internal IP" succeeds.

On the other hand a ping to a device on your internal network goes through the FORWARD chain where your firewall rules drop it.

  • Iptables firewalling is packet based, iptables NAT is connection based. – plugwash Dec 2 '16 at 4:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.