ipset and hash:net,iface type

[Thomas Martin]

Hi all,

I'm not able to make ipset works with the "hash:net,iface" type.

I test it with 6.12 and 6.21 on a Debian Wheezy (kernel: 3.2,
iptables: 1.4.14-3.1).

The only real custom is that the interfaces are vlans interfaces and
they are renamed (with ifrename).
For example eth0.100 is vlan100


Here is my configuration (I know this rules are ugly, this is only to test):
# ipset list all_users_if
Name: all_users_if
Type: hash:net,iface
Revision: 0
Header: family inet hashsize 4096 maxelem 65536
Size in memory: 33600
References: 2
Members:
172.20.128.0/24,vlan10
172.20.130.0/24,vlan100


# iptables -L FORWARD -vn
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 silentaccept all -- vlan10 * 172.20.128.0/24
0.0.0.0/0 state NEW match-set all_users_if dst,dst
0 0 silentaccept all -- vlan10 * 172.20.128.0/24
0.0.0.0/0 state NEW match-set all_users_if dst
7 420 statefull all -- * * 0.0.0.0/0
0.0.0.0/0
7 420 logdrop all -- * * 0.0.0.0/0
0.0.0.0/0 state NEW


Finally here is the log (doing a simple telnet on port 22 from
172.20.128.41 to 172.20.130.200):
drop: IN=vlan10 OUT=vlan100 MAC=blablabla SRC=172.20.128.41
DST=172.20.130.200 LEN=60 TOS=0x10 PREC=0x00 TTL=63 ID=26887 DF
PROTO=TCP SPT=50617 DPT=22 WINDOW=14600 RES=0x00 SYN URGP=0


Please note that this is working with this rules (without ipset):
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
5 324 silentaccept all -- vlan10 vlan100 172.20.128.0/24
172.20.130.0/24 state NEW
0 0 statefull all -- * * 0.0.0.0/0
0.0.0.0/0
0 0 logdrop all -- * * 0.0.0.0/0
0.0.0.0/0 state NEW



I really don't understand what I'm missing...

Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html

[Thomas Martin]

This is it.
When I try without renaming my vlans interfaces this is working...

Here is a simple test:

1) initial test
a) no iptables configuration (accep all)
# iptables -L -vn
Chain INPUT (policy ACCEPT 1090 packets, 216K bytes)
pkts bytes target prot opt in out source
destination
Chain FORWARD (policy ACCEPT 13 packets, 708 bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 1044 packets, 223K bytes)
pkts bytes target prot opt in out source destination

b) telnet from 172.20.128.41 (work as expected):
$ telnet 172.20.130.200 631
Trying 172.20.130.200...
Connected to 172.20.130.200.
Escape character is '^]'.
^]quit
telnet> quit
Connection closed.


2) ipset's configuration:
ipset list all_users_if
Name: all_users_if
Type: hash:net,iface
Revision: 0
Header: family inet hashsize 4096 maxelem 65536
Size in memory: 33168
References: 1
Members:
172.20.130.0/24,vlan130
172.20.130.0/24,internal.130


3) I will try to block the telnet without renaming the interface
a)
# ifconfig internal.130
internal.130 Link encap:Ethernet HWaddr blablabla
inet addr:172.20.130.252 Bcast:172.20.130.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:440 errors:0 dropped:0 overruns:0 frame:0
TX packets:22 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:18840 (18.3 KiB) TX bytes:1572 (1.5 KiB)

b)
# iptables -L -vn
Chain INPUT (policy ACCEPT 26 packets, 2770 bytes)
pkts bytes target prot opt in out source
destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 REJECT all -- * * 0.0.0.0/0
0.0.0.0/0 state NEW match-set all_users_if dst,dst reject-with
icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 22 packets, 3441 bytes)
pkts bytes target prot opt in out source destination

c) As expected the telnet was blocked
$ telnet 172.20.130.200 631
Trying 172.20.130.200...
telnet: Unable to connect to remote host: Connection refused

Ipset works as expected!


4) I will do the exact same test with internal.130 renamed to vlan130:
a) ifrename -i internal.130 -n vlan130
# ifconfig vlan130
vlan130 Link encap:Ethernet HWaddr blablabla
inet addr:172.20.130.252 Bcast:172.20.130.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2 errors:0 dropped:0 overruns:0 frame:0
TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:84 (84.0 B) TX bytes:238 (238.0 B)

b)
# iptables -L -vn
Chain INPUT (policy ACCEPT 14 packets, 1371 bytes)
pkts bytes target prot opt in out source
destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 REJECT all -- * * 0.0.0.0/0
0.0.0.0/0 state NEW match-set all_users_if dst,dst reject-with
icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 11 packets, 1606 bytes)
pkts bytes target prot opt in out source destination

c) This time the telnet is still working:
$ telnet 172.20.130.200 631
Trying 172.20.130.200...
Connected to 172.20.130.200.
Escape character is '^]'.
^]quit
telnet> quit
Connection closed.


So it seems that ipset is having some issue working with ifrename.



--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to ***@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html