ankit's questions

I am trying to learn how to implement virtual interfaces using the Tap driver.

So far my understanding is that using the tap driver I can create a virtual interface and then have a userspace program attach to this interface to analyse the data coming into this device.

Now what if I attach a cisco switch to my LAN interface using a TRUNK link, forward all the packets coming into the LAN interface to the virtual tap interface and then in my program attached to this interface do some coding to analyze the vlan tag in the packet and only allow certain vlans to be forwarded to the WAN interface?

Does this sound plausible or is there is flaw in my basic understanding?

Update: Now that I have played more with it I have few more questions:

So i have my tun interface created (tun0) that does receive packets. With these packets I am doing some filtering (allowing/dropping) based on the "SRC MAC Address" in the ethernet frame. The question, how do I send the allowed packets to one of my WAN interfaces (eth0) now?

I had initally asked question about sertting up my linux box for natting for my home network and was given suggestions in the thread here. Did not want to clutter the old question so starting a new one here.

based on the earlier suggestions, i have come up with the following rules ...

:PREROUTING ACCEPT [1:48]
:OUTPUT ACCEPT [12:860]
:POSTROUTING ACCEPT [3:228]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT

*filter
:INPUT DROP [3:228]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -p icmp -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -i eth1 -p icmp -j ACCEPT
-A FORWARD -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -i eth1 -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
-A OUTPUT -j ACCEPT
COMMIT

If you notice, i do have the proper MASQURADING rule and the proper FORWARD filter rule as well. However i am facing 2 problems

1. On the linux box itself DNS resolving is not working
2. the lan clients connected to the linux box, are still not able to get to internet. when i ping something from them, i see the DROP count in iptables INPUT rule increasing.

now my question is, when i am pinging something from the lan client, how come it is being matched by the input chain ?! should it be in the forward chain ?

Chain INPUT (policy DROP 20 packets, 2314 bytes)
 pkts bytes target     prot opt in     out     source               destination
   99  9891 ACCEPT     all  --  lo     any     anywhere             anywhere
    0     0 ACCEPT     icmp --  eth0   any     anywhere             anywhere
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere            tcp dpt:http
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere            tcp dpt:https
  122  9092 ACCEPT     tcp  --  eth0   any     anywhere             anywhere            tcp dpt:ssh

Thanks ankit

UPDATE:

I have managed to work out the DNS problems. the only thing not working right now is the forwarding.

These are the rules i have right now

Chain INPUT (policy DROP 1158 packets, 89867 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere
   59  5448 ACCEPT     icmp --  any    any     anywhere             anywhere
  643 47995 ACCEPT     udp  --  eth0   any     anywhere             anywhere            udp spt:domain dpts:1024:65535
   54  7811 ACCEPT     tcp  --  eth0   any     anywhere             anywhere            tcp dpt:http
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere            tcp dpt:https
 4168  273K ACCEPT     tcp  --  eth0   any     anywhere             anywhere            tcp dpt:ssh

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere
 1806  156K ACCEPT     tcp  --  eth1   any     anywhere             anywhere            tcp dpt:http
   91 19451 ACCEPT     tcp  --  eth1   any     anywhere             anywhere            tcp dpt:https
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere            udp spts:1024:65535 dpt:domain
10973  638K LOG_DROP   all  --  any    any     anywhere             anywhere

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   80  6734 ACCEPT     icmp --  any    any     anywhere             anywhere
 6327 2445K ACCEPT     all  --  any    any     anywhere             anywhere

Chain LOG_DROP (1 references)
 pkts bytes target     prot opt in     out     source               destination
10973  638K LOG        all  --  any    any     anywhere             anywhere            LOG level warning tcp-options ip-options prefix `[IPTABLES DROP] :'
10973  638K DROP       all  --  any    any     anywhere             anywhere

1. As you can see i have created a LOG_DROP rule to log all the dropped packets
2. on one of my LAN clients i am pinging google, but get no reply

this is what i see in the message log

Feb 12 17:15:15 LINUX-GATEWAY kernel: [206384.605899] [IPTABLES DROP] :IN=eth1 OUT=eth0 SRC=192.168.4.100 DST=74.125.226.80 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=15546 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=11288
Feb 12 17:15:20 LINUX-GATEWAY kernel: [206389.606038] [IPTABLES DROP] :IN=eth1 OUT=eth0 SRC=192.168.4.100 DST=74.125.226.80 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=15560 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=11289
Feb 12 17:15:25 LINUX-GATEWAY kernel: [206394.607171] [IPTABLES DROP] :IN=eth1 OUT=eth0 SRC=192.168.4.100 DST=74.125.226.80 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=15573 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=11290
Feb 12 17:15:30 LINUX-GATEWAY kernel: [206399.606336] [IPTABLES DROP] :IN=eth1 OUT=eth0 SRC=192.168.4.100 DST=74.125.226.80 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=15588 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=11291
Feb 12 17:15:35 LINUX-GATEWAY kernel: [206404.620397] [IPTABLES DROP] :IN=eth1 OUT=eth0 SRC=192.168.4.100 DST=74.125.226.80 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=15603 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=11292

So the ping packets from the lan client are being dropped in the forward chain (only chain with log_drop)

I cant figure out why .. any ideas ?

I am new to iptables and trying to set my linux server as a gateway for my other computers.So naturally I am playing with iptables and needed some help

My server has 2 NIC cards, eth0(WAN) and eth1(LAN)

my goals are:

1. For me to have ssh access to the linux server
2. Forward all http(80) and https(443) traffic coming into eth1(LAN) to eth0 and do ip masquerading
3. All other traffic coming into eth1(mainly DHCP requests from LAN clients) should not be forwarded to eth0
4. Not allow the LAN clients to run any service ie. only have access to the web(tcp:80/443)

The rules I have so far are:

#To clear all IPTables Rules
iptables --flush            
iptables --table nat --flush
iptables --delete-chain     
iptables --table nat --delete-chain

#allow me to ssh into the server + access the web server on it
#ssh
iptables --table FILTER -A INPUT -p tcp --dport 22 -j ACCEPT
#webserver
iptables --table FILTER -A INPUT -p tcp --dport 80 -j ACCEPT
#drop everything else
iptables --table FILTER -A INPUT -j DROP

#enable IP Masquerading on eth0
iptables --table NAT -A POSTROUTING --out-interface eth0 -j MASQUERADE

#accept incoming traffic from eth1
#http
iptables --table FILTER -A INPUT -p tcp -dport 80 --in-interface eth1 -j ACCEPT
#https
iptables --table FILTER -A INPUT -p tcp -dport 443 --in-interface eth1 -j ACCEPT
#drop everything else
iptables --table FILTER -A INPUT --in-interface eth1 -j DROP

So at this point I have the http/https traffic coming in from eth1(which was allowed to come in by iptables) and my eth0 line ready for masquerading.

My question is How do i forward this traffic from eth1 to eth0 ?

Any help would be much appreciated,
ankit

Another day, another question !

I am trying to write a script that would monitor my LAN for any new new devices connected to it and if it finds a new device, send me an email.

My test network is a very simple one consisting of just 1 cisco 2900XL switch. So far the script can runs every 2 minutes (cronjob) and finds the new mac address.

How can I get the IP information corresponding to the mac found? This is what I have so far :

1. Scan scan through the DHCP leases file of the dhcp server to see what IP was assigned to the device (if the device is set to DHCP though)

2. If my network had a router look through its routing tables for the mac entry, but my setup is a simple one and does not need one.

Also method#1 would fail if the device had a static ip on it.

Any ideas for this ?

thanks
-ankit

I have asked this question before but with not much success. I guess i was confused and did not put my question properly. So here it goes again.

Some points before i begin:

1. I am running FC 14
2. I did not install apache manually ... used yum
3. safe mode in PHP is turned OFF

Basically I want to execute ping command and show the results on the PHP page. The code I use is

<?php
$who = shell_exec('whoami');
$result1 = shell_exec("/webserver_commands/ping -c 4 www.google.com");
exec("ping -c 4 www.google.com",$result2);

echo $who;
echo "<br/>".$result1;
echo "<br/>".$result2;
?>

The Output I get is

apache 

Array

So I know the scripts are being run as the user 'apache'

In the apache log I see the following lines

sh: /webserver_commands/ping: Permission denied
ping: icmp open socket: Permission denied

I have made sure the directory /webserver_commands/ and the file ping in it are owned by the user apache of the group apache

917506 drwxrwxrwx.   2 apache apache  4096 Feb  4 18:29 webserver_commands
917507 -rwxrwxrwx. 1 apache apache 43448 Feb  4 18:29 ping

Any ideas what could be going wrong here ?

thank you, -ankit

what i am trying to acomplish is to have a php page execute a shell command and display the output on the web page.

the code for the page is something along the lines of

<?php
echo shell_exec('ls -l /code');
?>

when i load up this page all i see is blank. yet when i execute it from the command line i see the command being executed and the output printed.

I am sure its something to do with the permissions and i am hoping someone can point me the right way.

this is what I see in the httpd log file

ls: cannot access /gateway_code: Permission denied
ls: cannot access /gateway_code: Permission denied

BTW the directory /code is set to "Read only" for the user "apache"

thanks! -ankit

Basically what i want to do is to find out what is the mac address of a device plugged in to an interface on the switch (FastEthernet0/1 for example)

reading through the switch documentaion i found out that i can configure snmp trap on it to make it notify of any new mac address the switch detects by using the command

snmp-server enable traps mac-notifiction

but for some reason my switch does not support this feature. the only options i see are

CORE_SWITCH(config)#snmp-server enable traps ?
  c2900            Enable SNMP c2900 traps
  cluster          Enable Cluster traps
  config           Enable SNMP config traps
  entity           Enable SNMP entity traps
  hsrp             Enable SNMP HSRP traps
  snmp             Enable SNMP traps
  vlan-membership  Enable VLAN Membership traps
  vtp              Enable SNMP VTP traps
  <cr>

so the other way would be for me to run a cronjon on my gateway to poll the switch periodically using snmp to get new mac addresses

i have looked everywhere but cant seem to find the OID that would provide me this information.

any help i can get would me very much appreciated !

here's the output from "show version" on my switch

Cisco Internetwork Operating System Software
IOS (tm) C2900XL Software (C2900XL-C3H2S-M), Version 12.0(5.4)WC(1), MAINTENANCE INTERIM SOFTWARE
Copyright (c) 1986-2001 by cisco Systems, Inc.
Compiled Tue 10-Jul-01 11:52 by devgoyal
Image text-base: 0x00003000, data-base: 0x00333CD8

ROM: Bootstrap program is C2900XL boot loader

CORE_SWITCH uptime is 1 hour, 24 minutes
System returned to ROM by power-on
System image file is "flash:c2900XL-c3h2s-mz.120-5.4.WC.1.bin"


cisco WS-C2912-XL (PowerPC403GA) processor (revision 0x11) with 8192K/1024K bytes of memory.
Processor board ID FAB0409X1WS, with hardware revision 0x01
Last reset from power-on

Processor is running Enterprise Edition Software
Cluster command switch capable
Cluster member switch capable
12 FastEthernet/IEEE 802.3 interface(s)

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:01:42:D0:67:00
Motherboard assembly number: 73-3397-08
Power supply part number: 34-0834-01
Motherboard serial number: FAB040843G4
Power supply serial number: DAB05030HR8
Model revision number: A0
Motherboard revision number: C0
Model number: WS-C2912-XL-EN
System serial number: FAB0409X1WS
Configuration register is 0xF

thanks, -ankit

I have a question about the dhcp server on linux

Basically my server has 2 interface cards

• eth0 : 192.168.2.201/255.255.255.0
• eth1 : 192.168.4.1/255.255.255.0
• eth1:0 : 10.1.1.0/24

On this server i am running the dhcpd daemon to hand out leases in the 192.168.4.0/24 subnet.

• eth0 : connected to my home router to access internet
• eth1 : connected to a cisco switch (with only default vlan) on port 1 with ip address 10.1.1.10 - this interface is used for communication with the switch for management through telnet

Now when i plug in another computer on any port on the switch i see the following

• the computer gets 169.254 self assigned ip
• i see the DHCP server did hand out a lease (/var/lib/dhcpd/dhcpd.leases file)
• under ethernet status on the client computer i see bytes sent but 0 received

Now my question is

To which interface on the linux server does the dhcpd daemon bound to ? Since i see the lease being assigned it is obviously getting the dhcp request yet the lease it sends out is not reaching the client.

Any help would be much appreciated !

thank you, ankit