0

I have a small network. network It has a firewall connected to the internet (WAN) with real IP and DNS name which also acts as a DHCP server for the internal network (LAN). On the firewall machine I've setup port forwarding for the site server located in LAN. Here's my nftables.conf:

#!/usr/sbin/nft -f

flush ruleset

define lan = eth0
define wan = eth1
define lan_addresses = 192.168.100.0/24
define server_address = 192.168.100.2
define server_http_port = 80
define server_https_port = 443

table firewall {
    map hosts {
        type ipv4_addr . ether_addr : verdict
            elements = {
                192.168.100.2  . 30:01:ED:BD:6B:CB : accept , # SERVER
                192.168.100.3  . 30:01:ED:BD:6B:C1 : accept , # CLIENT
            }
    }
    set remote_allowed {
            type ipv4_addr
            elements = { 91.198.174.192 , 209.51.188.148 }
    }
    chain prerouting {
        type nat hook prerouting priority 0; policy accept;
        # server
        iifname $wan ip protocol tcp tcp dport $server_http_port log prefix "Server HTTP Prerouted " dnat $server_address:$server_http_port
        iifname $wan ip protocol tcp tcp dport $server_https_port log prefix "Server HTTPS Prerouted " dnat $server_address:$server_https_port
    }
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        ip saddr $lan_addresses oifname $wan masquerade
        # server
        iifname $wan ip protocol tcp ip saddr $server_address tcp sport $server_http_port log prefix "Server HTTP Postrouted " masquerade
        iifname $wan ip protocol tcp ip saddr $server_address tcp sport $server_https_port log prefix "Server HTTPS Postrouted " masquerade
    }
    chain input {
        type filter hook input priority 0; policy drop;
        # drop invalid, allow established
        ct state vmap {invalid : drop, established : accept, related : accept}
        # allow loopback
        iifname "lo" accept
        # allow ping from LAN
        iifname $lan ip saddr $lan_addresses ip protocol icmp icmp type echo-request accept
        # allow SSH from LAN
        iifname != $wan ip protocol tcp tcp dport 22 accept
        # allow SSH from allowed remotes
        iifname $wan ip protocol tcp ip saddr @remote_allowed tcp dport 22 accept
        # open SQUID, DHCP port for lan
        iifname $lan ip protocol tcp ip saddr $lan_addresses tcp dport {3128, 67} accept
        # LAN nice reject
        iifname != $wan ip saddr $lan_addresses reject with icmp type host-prohibited
    }
    chain forward {
        type filter hook forward priority 0; policy drop;
        ct state {established,related} accept
        # server
        iifname $wan ip protocol tcp ip daddr $server_address tcp dport $server_http_port log prefix "Server HTTP Forwarded To " accept
        iifname $lan ip protocol tcp ip saddr $server_address tcp sport $server_http_port log prefix "Server HTTP Forwarded From " accept
        iifname $wan ip protocol tcp ip daddr $server_address tcp dport $server_https_port log prefix "Server HTTPS Forwarded To " accept
        iifname $lan ip protocol tcp ip saddr $server_address tcp sport $server_https_port log prefix "Server HTTPS Forwarded From " accept
        # only allow selected machines to access internet
        iifname $lan oifname $wan ip saddr . ether saddr vmap @hosts
        iifname $lan oifname $wan reject
    }
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

This setup works fine as long as I don't try to access my server from LAN, in which case I get No route to host error:

> ping 192.168.100.1 # OK
> ping example.com # OK
> curl http://192.168.100.2 # OK
> curl http://192.168.100.1 # `No route to host`
> curl http://93.184.216.34 # `No route to host`
> curl http://example.com   # `No route to host`

How can I modify netfilter configuration so I could access my LAN server using firewalls IP or DNS name?

PS I need this so I could properly configure jitsi meet conference recording via jigasi, which uses sites URL to connect to the conference.

PPS This configuration allows unlimited internet access only for the specified clients.

4
  • no route to host is an unrelated to firewall. Check the route on the host you have run ping May 25, 2021 at 10:41
  • @YetAnotherUser yes, problem is probably with prerouting/postrouting parts of the configuration. Ping works.
    – Sergey
    May 25, 2021 at 10:48
  • but why? If in the same lan the host talks directly, or am i wrong? pre and post rouiting are not touched. Lan packet are not routed at all. May 25, 2021 at 10:51
  • @YetAnotherUser some server components are trying to communicate with each other using server DNS name and fail to do so. Additionally, server TSL certificates are issued for the real IP and are not trusted when connecting from LAN. Not all applications allow using untrusted certificates.
    – Sergey
    May 25, 2021 at 11:23

1 Answer 1

0

I was able to overcome this problem without touching firewall configuration. I've added entry with the local server address and DNS name to the clients /etc/hosts file:

192.168.100.3   example.com

I think it could also be broadcasted by the DHCP server.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.