Home / server / Questions / 512258
Accepted
Daniel W.
Asked: 2013-06-01 04:13:53 +0800 CST

allowing forwarding on a root server, security risk?

  • 772

Having a root server without iptables rules (I know this is not good, it's just temporary tho in my case), and having configuration like this (for VPN reason):

echo 1 > /proc/sys/net/ipv4/ip_forwarding

iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth0 -j MASQUERADE

Does this include that any host is able to abuse my root server, use it as a router or forward traffic through it in any way?

linux

1 Answers

  1. Best Answer

    No. Only hosts on the same (physical or virtual) link can do that. The reason is that you must create a layer 2 (e.g. Ethernet) packet which is aimed at your system but contains an IP target address which is not that of your system.

    Hosts which need at least one gateway to reach your system need the help of at least one (maybe all, depending on the circumstances) of these gateways to get this done.

    • 1