I could not understand Joao's statement, so I tend to disagree that
there is no layer2 traffic flowing on a NAT box. Makes no sense to me. I
am sure it is possible to do all 2 sub-layer layer 2 filtering (MAC and
LLC).
So I have just tried what you are willing to get working Lubomir, right
now in the network I am.
My current enviroment is the simplest the possible:
[ 10.69.0.0/16 network ] <=> [ switch ] <=> [FreeBSD] <=> [Internet]
My external interface is vr0
My internal one is xl0
I have just allowed two stations to go to the DIVERT (natd) rules by
using skipto approach, and all other machines are not skipped, so they
tend to match an intermediary rule which does deny all traffic based on
layer2. I kept only the relevant rules so it gets very clear to understand:
# ipfw show
00300 688 62538 skipto 1000 ip from any to any { MAC any
08:00:46:bd:da:a3 or MAC any 00:17:31:df:bc:ab } layer2
00310 637 84252 skipto 1000 ip from any to any { MAC
08:00:46:bd:da:a3 any or MAC 00:17:31:df:bc:ab any } layer2
00500 468 30071 deny log logamount 100 ip from any to any MAC any
any layer2 via xl0
01000 527 50710 divert 8668 ip from 10.69.0.0/16 to any out via vr0
01100 556 68585 divert 8668 ip from any to me in via vr0
65535 14642 1214437 allow ip from any to any
In case ipfw list may be clearer:
# ipfw list
00300 skipto 1000 ip from any to any { MAC any 08:00:46:bd:da:a3 or MAC
any 00:17:31:df:bc:ab } layer2
00310 skipto 1000 ip from any to any { MAC 08:00:46:bd:da:a3 any or MAC
00:17:31:df:bc:ab any } layer2
00500 deny log logamount 100 ip from any to any MAC any any layer2 via xl0
01000 divert 8668 ip from 10.69.0.0/16 to any out via vr0
01100 divert 8668 ip from any to me in via vr0
65535 allow ip from any to any
Some relevant information: I am doing selective divert based on my
network, on vr0 (external interface) while explicitly denying all layer2
traffic based on mac, on rule 500, only on xl0 (internal network),
because if I do it on all networks or on vr0, I will certainy deny my
own outgoing packets.
So it worked perfectly, and right now while I send this message only the
two MAC addresses are allowed to get diverted to natd (and go to internet).
As you can see, some traficc is still hitting rule # 500, so I want to
know what it is:
# grep 500 /var/log/security | tail -5
Apr 22 19:54:32 HomerSimpson kernel: ipfw: 500 Deny UDP
208.239.76.163:5060 10.69.69.39:5060 out via xl0
Apr 22 19:54:33 HomerSimpson kernel: ipfw: 500 Deny MAC in via xl0
Apr 22 19:54:36 HomerSimpson kernel: ipfw: 500 Deny UDP
208.239.76.163:5060 10.69.69.39:5060 out via xl0
Apr 22 19:54:37 HomerSimpson kernel: ipfw: 500 Deny MAC in via xl0
Apr 22 19:54:50 HomerSimpson kernel: ipfw: limit 100 reached on entry 500
So, it is IP 10.69.69.39, which for sure has a different MAC address:
# arp 10.69.69.39
? (10.69.69.39) at 00:12:17:fb:ee:e7 on xl0 [ethernet]
You also said you wanted allow other stations to talk to the gateway,
what in the above examples, I am not allowing, so for example if I add
rule 400 like this:
# ipfw add 400 allow all from 10.69.0.0/16 to me via xl0 not layer2
keep-state
00400 allow ip from 10.69.0.0/16 to me via xl0 not layer2 keep-state
I am certainly allowing any station on 10.69/16 network, regardless of
its IP address (unless it is on 10.69/16 network) or MAC address (since
I am not filtering on layer2):
# ipfw show
00300 2544 519800 skipto 1000 ip from any to any { MAC any
08:00:46:bd:da:a3 or MAC any 00:17:31:df:bc:ab } layer2
00310 2415 601710 skipto 1000 ip from any to any { MAC
08:00:46:bd:da:a3 any or MAC 00:17:31:df:bc:ab any } layer2
00400 29 2548 allow ip from 10.69.0.0/16 to me via xl0 not layer2
keep-state
00500 1236 65813 deny log logamount 100 ip from any to any MAC any
any layer2 via xl0
01000 1904 469946 divert 8668 ip from 10.69.0.0/16 to any out via vr0
01100 2049 525859 divert 8668 ip from any to me in via vr0
65535 42049 5911000 allow ip from any to any
Since ipfw is a first-match-based firewall you don't need to worry about
this "allow from any to any" rule, because the hosts which get to this
rule certainly were not skipped on the later rules, so they simply never
get diverted, because they match on this "allow" and divert rules
happens AFTER the allow.
Lets see who is matching rule # 400 (which is a keep-state rule, so it
is generating dynamic state rules):
## Dynamic rules (2):
00400 1 100 (1s) STATE tcp 10.69.2.40 59235 <-> 10.69.2.1 22
00400 0 0 (0s) STATE udp 10.69.69.13 59577 <-> 10.69.69.1 53
Both 10.69.2.1 and 10.69.69.1 are "me" (the firewall itself). So just
perfect, anyone can freely go through the private network, in the above
dynamic we see an ssh session and an expired DNS query to the firewall
which for sure is also the DNS server for the network).
Last thing, remember to enabled ethernet filtering on IPFW:
sysctl -w net.link.ether.ipfw=1
If not, no layer2 filtering will be processed at all.
Also, when doing layer2 filtering, remember that the default IPFW
behavior is to filter layer3 and above layers, but when you set
net.link.ether.ipfw to true, it does layer2 and above, so all traffic
going via ether_demux() and ether_output_frame() gets filtered.
But the thing is that on the IP stack - /sys/net/if_ethersubr.c (where
ether_demux() and ether_output_frame() happen) - layer2 traffic happen
before the upper layers. So when doing ipfw layer firewall remember:
- layer2 rules will get processed first
- non layer specified rules will get processed two times, on layer2 and
upper layers
- not layer2 (meaning all upper layers) will get processed only later
Hope this working example is a good start poing for your setup.
Lubomir Georgiev escreveu:
Thanks for the response but I have to disagree with you - I have read the
responses time and time again with great attention, but to no avail. From
what you said I understand that in order to utilize MAC address filtering I
would need a managed switch or another box aside from the one that will be
performing the NATing - is that right? Are you sure that there's no way to
combine MAC filtering with NAT in a single box?
Just to make things clear I'll give an example of what I want to do - I
want a machine with say MAC-a to have internet connectivity regardless of
its IP address - that is I can assign to it any of the
192.168.1.Xaddresses. But if a machine with say MAC-b comes into the
network and tries
any IP I want it to be excluded from the NATd rule but still have
connectivity with the FreeBSD box - so that I can open up a terminal and
add
it to the rulelist if I want Inet connectivity on that machine.
P.S. I have heard of another way of filtering which uses the ARP tables -
any comments on that? The thing that I don't think I'll be able to
accomplish with the ARP tables is to use any of the 192.168.1.X IP
addresses.
Once again thanks for all your help and I hope we can reach the final
conclusion of this problem.
--
Patrick Tracanelli
FreeBSD Brasil LTDA.
(31) 3281-9633 / 3281-3547
[EMAIL PROTECTED]
http://www.freebsdbrasil.com.br
"Long live Hanin Elias, Kim Deal!"
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
