OK, so I take it there are no shorewall rules that are associated with route
filtering. Is route filtering then an operation performed by the kernel, as per RFC
1812? Deciding what routes to trust from what sources?
Also, how is this related to IPSEC? I am curious because we have had no success with
IPsec between some machines on campus. A "no route found" message was found in a log
file -- with spoofprotect=NO and no routefilter option --.
(see previous post of Erichs about no route found).
As the script below seems to indicate, the first thing done is to set all
.../ethx/rp_filters to 0. Then set the interfaces with route_filter options to 1.
But, as Tom's message below indicates, we need to set .../all/rp_filter to 1. The
script does not do this. (Why? Done somewhere else?)
BTW, This is in Bering 1.2, and from a previous search through the archives (see
previous post "spoofprotect=NO versus YES") I found that Tom Eastep wrote the
following... Thought I would include this.
THx -- Rick.
============== Begin Snip ======================
There are several problems here.
a) The advice that /proc/sys/net/ipv4/conf/eth0/rp_filter should be zero
is bogus. I ran an IPSEC tunnel with that flag set to 1 for over a year
with no problems other than an annoying message when IPSEC started. You
*might* see problems if /proc/sys/net/ipv4/conf/all/rp_filter is also
set (that"s required to actually perform route-based filtering on those
interfaces whose flag is also set).
b) There is another way in which that flag can be turned on:
/etc/shorewall/interfaces -- routefilter option.
c) /proc has no backing store; it is a file system materialized in
memory with no disk underneath it. So it is impossible to back up that
setting in the literal sense. What you rather need to do is to change
those config files that cause the flag to be set to 1 (such as
/etc/network/options and /etc/shorewall/interfaces) then back up THOSE
files.
-Tom
--
Tom Eastep \ Nothing is foolproof to a sufficiently talented fool
Shoreline, \ http://shorewall.net
Washington USA \ [EMAIL PROTECTED]
============== End Snip =========================
-----Original Message-----
From: Erich Titl [mailto:[EMAIL PROTECTED]
Sent: Monday, October 11, 2004 5:28 PM
To: Tibbs, Richard; [EMAIL PROTECTED]
Subject: Re: [leaf-user] routefilter option makes no difference in rules
At 16:40 11.10.2004 -0400, you wrote:
>Hello, list:
>I tried an experiment and added the routefilter option on eth0 to the
>internet. Before I did that, with spoofprotect = yes in
>/etc/network/options, I executed iptables -L.
>Then, put the routefilter option on eth0 in shorewall, rebooted, and ran
>iptables again. Comparing both files yielded no differences.
>
>Any ideas?
Mhhh try to.....
here seems to be the relevant code from firewall
interfaces="`find_interfaces_by_option routefilter`"
if [ -n "$interfaces" -o -n "$ROUTE_FILTER" ]; then
echo "Setting up Kernel Route Filtering..."
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
echo 0 > $f
done
for interface in $interfaces; do
file=/proc/sys/net/ipv4/conf/$interface/rp_filter
if [ -f $file ]; then
echo 1 > $file
else
error_message \
"Warning: Cannot set route filtering on $interface"
fi
done
As you see, this is not doing anything to the netfilter, so of course you
will not see anything by looking at them
cheers
Erich
THINK
P�ntenstrasse 39
8143 Stallikon
mailto:[EMAIL PROTECTED]
PGP Fingerprint: BC9A 25BC 3954 3BC8 C024 8D8A B7D4 FF9D 05B8 0A16
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
------------------------------------------------------------------------
leaf-user mailing list: [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-user
SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
