SNAT static vs. dynamic ip = pppoe

[Tim Rodriguez]

Ok, I have loaded roaming peguin pppoe client for my DSL connection and I need to alter my rules script to allow connections out the ppp0 interface that rp-pppoe client creates. If my understanding is correct, (please feel free to make constructive suggestions), if you have a dynamically assigned ip address, it is better to use MASQUERADE.

Example: iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

This due to the fact that MASQUERADE will obtain the presently assigned dynamic ip address and assigning it to every single packet going out through ppp0....correct? So no matter what ip address is dynamically assigned by my ISP I will always have a connection to the Internet via MASQUERADE...correct?

If I have a static ip address, (and I do), it is better to use SNAT.

Example: iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to 1.2.3.4

This will make matters more efficient due to the fact that SNAT automatically assigns the --to 1.2.3.4 ip address to every packet without the overhead of having to obtained the ip address. Is this correct so far?

Now, I have had some problems with my ISP in then getting it right with my account statically assigning my ip address...I have had the experience where my ip address has changed in the past, as if I my account where set for dynamically assigned ip address. I have called then and they "supposedly" have fixed this. My ip address has recently stayed static.

To avoid future inabilities to access the Internet and knowing that my ISP has, in the past, bungle my account; would it be a safer bet to use MASQUERADE even though at the moment my ip address seems to be staying static? They may have finally gotten my account right.

Your comments, construtive suggestions, remarks and confirmations about my thinking will be gratefully appreciated, as always.

Sincerely,
Tim Rodriguez
Network Security Student

[Joel Newkirk]

Post by Tim Rodriguez
Ok, I have loaded roaming peguin pppoe client for my DSL connection and I
need to alter my rules script to allow connections out the ppp0 interface
that rp-pppoe client creates. If my understanding is correct, (please feel
free to make constructive suggestions), if you have a dynamically assigned
ip address, it is better to use MASQUERADE.

Necessary, if the IP changes very often.

Post by Tim Rodriguez
Example: iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
This due to the fact that MASQUERADE will obtain the presently assigned
dynamic ip address and assigning it to every single packet going out
through ppp0....correct? So no matter what ip address is dynamically
assigned by my ISP I will always have a connection to the Internet via
MASQUERADE...correct?

That's the idea.

Post by Tim Rodriguez
If I have a static ip address, (and I do), it is better to use SNAT.
Example: iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to 1.2.3.4
This will make matters more efficient due to the fact that SNAT
automatically assigns the --to 1.2.3.4 ip address to every packet without
the overhead of having to obtained the ip address. Is this correct so far?

Precisely.

Post by Tim Rodriguez
Now, I have had some problems with my ISP in then getting it right with my
account statically assigning my ip address...I have had the experience
where my ip address has changed in the past, as if I my account where set
for dynamically assigned ip address. I have called then and they
"supposedly" have fixed this. My ip address has recently stayed static.
To avoid future inabilities to access the Internet and knowing that my ISP
has, in the past, bungle my account; would it be a safer bet to use
MASQUERADE even though at the moment my ip address seems to be staying
static? They may have finally gotten my account right.

Safer, probably, but likely unnecessary. I am technically on a dynamic IP
with my ADSL, although it rarely changes unless the ADSL modem is reset. I
have found the following to work well for me, and probably would be quite
suitable for your situation.

# PPPIP set to the IP of EXTIF, assumes it remains unchanged until
# reboot (or firewall restart) but is not truly static
PPPIP=$(/sbin/ifconfig "$EXTIF" | grep inet | cut -d":" -f 2 | cut -d" " -f 1)
# If PPPIP is different from the IP in our SNAT, issue warning
if !($IPTABLES -t nat -L | grep SNAT | cut -d":" -f 2 | grep -q $PPPIP)
then echo "IP has changed to "$PPPIP", Please issue restart."
fi

The only part you would need is the PPPIP assignment, which extracts the
current IP from "ifconfig ppp0". (EXTIF="ppp0" earlier in my script) The
remainder is useful for me because my firewall is a fully parameterized
script, so each time I call it (ie service firewall list, or actually "fw
list" since I have a shell alias set up) it checks the setting and notifies
me if the IP has changed from what my current rules use.

Post by Tim Rodriguez
Your comments, construtive suggestions, remarks and confirmations about my
thinking will be gratefully appreciated, as always.
Sincerely,
Tim Rodriguez
Network Security Student

j

[Louie]

Hello all,

Hope that everyone had a good
Thanksgiving and weekend. Well I have a
question for you guys regarding red hat
8. I have just installed it. I got an
alert from the red hat update. Does
anyone trust that update program?

Is that the way to update patches and
other holes in red hat now?

Can anyone help me out?

Louie

[Tom Diehl]

What does this have to do with netfilter? suggest subscribing to one of the Red Hat
support lists. Having said that see below.

Post by Louie
Hello all,
Hope that everyone had a good
Thanksgiving and weekend. Well I have a
question for you guys regarding red hat
8. I have just installed it. I got an
alert from the red hat update. Does
anyone trust that update program?

If you trust Red Hat to do the right thing than I suppose you can trust
up2date. If you do not than I would suggest you find a different distro.
All packages distributed by Red Hat for the production releases are gpg
signed. If you trust that the key has not been compromised then all
should be ok.

IOW, just how paranoid are you?

Post by Louie
Is that the way to update patches and
other holes in red hat now?

It does not install patches. It installs updated rpms. It is one of many
ways to keep systems updated. I do not use it personally but a lot of others
like it.

Post by Louie
Can anyone help me out?

You could help yourself out by doing a little homework and/or asking on the
correct mailing list.

Hope this helps,

[Elgene C. Castaneda]

Hello all!

I've downloaded RH8 on redhat site but the disk 2 got an error when
installing, also the disk can't passed the "disk test" of RH. I already
wasted 3 cdr for disc 2.

Anyone know wher to download RH8?

Thanks
----- Original Message -----
From: "Tom Diehl" <***@rogueind.com>
To: "Louie" <***@pacbell.net>
Cc: "iptables-list" <***@lists.samba.org>
Sent: Sunday, December 01, 2002 7:27 PM
Subject: Re: Red Hat 8

Post by Tom Diehl
What does this have to do with netfilter? suggest subscribing to one of the Red Hat
support lists. Having said that see below.

Post by Louie
Hello all,
Hope that everyone had a good
Thanksgiving and weekend. Well I have a
question for you guys regarding red hat
8. I have just installed it. I got an
alert from the red hat update. Does
anyone trust that update program?

If you trust Red Hat to do the right thing than I suppose you can trust
up2date. If you do not than I would suggest you find a different distro.
All packages distributed by Red Hat for the production releases are gpg
signed. If you trust that the key has not been compromised then all
should be ok.
IOW, just how paranoid are you?

Post by Louie
Is that the way to update patches and
other holes in red hat now?

It does not install patches. It installs updated rpms. It is one of many
ways to keep systems updated. I do not use it personally but a lot of others
like it.

Post by Louie
Can anyone help me out?

You could help yourself out by doing a little homework and/or asking on the
correct mailing list.
Hope this helps,
--
.............Tom "Nothing would please me more than being able to
with good software." -- Bill Gates 1976
We are still waiting ....

[hard__ware]

Ok, I have loaded roaming peguin pppoe client for my DSL connection and =
I need to alter my rules script to allow connections out the ppp0 =
interface that rp-pppoe client creates. If my understanding is correct, =
(please feel free to make constructive suggestions), if you have a =
dynamically assigned ip address, it is better to use MASQUERADE.

This is not always the case, i have a xDSL connection that is Dynamic and
always changing
(unlike Joel Newkirk's Internet Connection) & i also require more than one
SNAT / Masquerade Rule

Example: I have many different Clients on my interenal network that are
untrusted and i like to block them at both the
forward chain & postrouting chain.(it has been proven that you can overload
firewalls and they can skip rules)
to make this easy i went and removed all the Comments From -->
/etc/hosts.allow so that it only states ip address's .. like so ...
in '/etc/hosts/allow'
-----SOF After Line-----
192.168.0.2
192.168.0.3
192.168.0.4
192.168.0.111
192.168.0.123
-----EOF Before Line----

So with a bash sequence like such we can perform all these entries in one go
...

if [ -f /etc/hosts.allow ]; then
while read ALLOW; do

$IPTABLES -A INPUT -i $LANIF -s $ALLOW -d $LANIP -j ACCEPT
$IPTABLES -A FORWARD -i $LANIF -o $WANIF -s $ALLOW -d 0.0.0.0/0 -j ACCEPT
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -d $ALLOW -m state --state
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -t nat A POSTROUTING -o $WANIF -s $ALLOW -d 0.0.0.0/0 -j SNAT --to
$WANIP
done < /etc/hosts.allow
fi

Example: iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
This due to the fact that MASQUERADE will obtain the presently assigned =
dynamic ip address and assigning it to every single packet going out =
through ppp0....correct? So no matter what ip address is dynamically =
assigned by my ISP I will always have a connection to the Internet via =
MASQUERADE...correct?

Exactly what Joel said .. ;-D " That's the idea."

If I have a static ip address, (and I do), it is better to use SNAT.=20
Example: iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to 1.2.3.4 =20
This will make matters more efficient due to the fact that SNAT =
automatically assigns the --to 1.2.3.4 ip address to every packet =
without the overhead of having to obtained the ip address. Is this =
correct so far?

your on the right track ...

Now, I have had some problems with my ISP in then getting it right with =
my account statically assigning my ip address...I have had the =
experience where my ip address has changed in the past, as if I my =
account where set for dynamically assigned ip address. I have called =
then and they "supposedly" have fixed this. My ip address has recently =
stayed static.
To avoid future inabilities to access the Internet and knowing that my =
ISP has, in the past, bungle my account; would it be a safer bet to use =
MASQUERADE even though at the moment my ip address seems to be staying =
static? They may have finally gotten my account right.

well that is really up to you, but what you can do is have a script in your
ppp config directory
called ' /etc/ppp/ip-up.local ' that gets executed right after
'/etc/ppp/ip-up ', you most likely wont
have this file and you will have to create it ...... In there its just like
a bash script
(except you dont have to declare the Shell at the Top), So becuase this file
will be run everytime
you reconnect to your ADSL or when your (DHCP lease expires / renews) you
will be able to launch
your firewall with the new inserted address each time.. Now make sure if
your going to use a Firewall script like this
you must make the script clear all chains including users chains &
predefined chains . Also what need to be done is detrmine your
Wan / PPP IP Address so we can use it in our script as a Variable, e.g.
$WANIP
So all we need to do is add a line to your /etc/ppp/ip-up.local thats runs
your Firewall Script e.g. /etc/rc.firewall

Firewall Examples:

--------- Start of Example------------
WANIF="ppp0"
LANIF="eth0"

IPTABLES=/usr/sbin/iptables
LSMOD=/sbin/lsmod
GREP=/bin/grep
AWK=/bin/awk

# Determine the external IP automatically:
# ----------------------------------------
WANIP="`/sbin/ifconfig $WANIF | grep 'inet addr' | awk '{print $2}' | sed -e
's/.*://'`"
# For STATIC IP addresses: #
# Please Comment the WANIP line above if using the line below .. :D
# WANIP="192.168.0.253"
# ----------------------------------------

$IPTABLES -P INPUT DROP
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT DROP
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABLES -t nat -P OUTPUT DROP
$IPTABLES -t nat -P PREROUTING DROP
$IPTABLES -t nat -P POSTROUTING DROP
$IPTABLES -F -t nat
$IPTABLES -F -t mangle
### Flush the user chain.. if it exists ###
if [ -n "`$IPTABLES -L | $GREP dandgit`" ]; then
$IPTABLES -F dandgit
fi

if [ -n "`$IPTABLES -L | $GREP SMB`" ]; then
$IPTABLES -F SMB
fi

### This Grabs the New IP Via $WANIP Becuase we already know its been set
via /etc/ppp/ip-up
### otherwise /etc/ppp/ip-up.local would not of launched, meaning we are not
connected yet ...

$IPTABLES -t nat -A POSTROUTING -o $WANIF -j SNAT --to $WANIP

-------------End OF Example-------------

did you get all that :-P ....

Anyway i hope some of this is usefull, see yas ..

Hard__warE

[Sam Pointer]

Slightly off-topic?

Try burning at a slower rate. When you download the ISO images get the MD5
checksums and confirm that the download is intact before burning an image.

-----Original Message-----
From: Elgene C. Castaneda [mailto:***@dap.edu.ph]
Sent: 02 December 2002 08:56
To: Tom Diehl; Louie
Cc: iptables-list
Subject: Re: Red Hat 8


Hello all!

I've downloaded RH8 on redhat site but the disk 2 got an error when
installing, also the disk can't passed the "disk test" of RH. I already
wasted 3 cdr for disc 2.

Anyone know wher to download RH8?

Thanks
----- Original Message -----
From: "Tom Diehl" <***@rogueind.com>
To: "Louie" <***@pacbell.net>
Cc: "iptables-list" <***@lists.samba.org>
Sent: Sunday, December 01, 2002 7:27 PM
Subject: Re: Red Hat 8

Post by Tom Diehl
What does this have to do with netfilter? suggest subscribing to one of

the Red Hat

Post by Tom Diehl
support lists. Having said that see below.

Post by Louie
Hello all,
Hope that everyone had a good
Thanksgiving and weekend. Well I have a
question for you guys regarding red hat
8. I have just installed it. I got an
alert from the red hat update. Does
anyone trust that update program?

If you trust Red Hat to do the right thing than I suppose you can trust
up2date. If you do not than I would suggest you find a different distro.
All packages distributed by Red Hat for the production releases are gpg
signed. If you trust that the key has not been compromised then all
should be ok.
IOW, just how paranoid are you?

Post by Louie
Is that the way to update patches and
other holes in red hat now?

It does not install patches. It installs updated rpms. It is one of many
ways to keep systems updated. I do not use it personally but a lot of

others

Post by Tom Diehl
like it.

Post by Louie
Can anyone help me out?

You could help yourself out by doing a little homework and/or asking on

the

Post by Tom Diehl
correct mailing list.
Hope this helps,
--
.............Tom "Nothing would please me more than being able to
with good software." -- Bill Gates 1976
We are still waiting ....

This email and any attachments are strictly confidential and are intended
solely for the addressee. If you are not the intended recipient you must
not disclose, forward, copy or take any action in reliance on this message
or its attachments. If you have received this email in error please notify
the sender as soon as possible and delete it from your computer systems.
Any views or opinions presented are solely those of the author and do not
necessarily reflect those of HPD Software Limited or its affiliates.

At present the integrity of email across the internet cannot be guaranteed
and messages sent via this medium are potentially at risk. All liability
is excluded to the extent permitted by law for any claims arising as a re-
sult of the use of this medium to transmit information by or to
HPD Software Limited or its affiliates.