LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 12-26-2003, 04:37 PM   #1
MaverickApollo
Member
 
Registered: Oct 2003
Distribution: Debian
Posts: 55

Rep: Reputation: 15
IPTables and multiple interfaces


I have two interfaces on my machine, and what I need to do is to close off eth1 using iptables due to that interface connecting directly to the DMZ on the router. (Snort is listening on the interface, and thats the interfaces only purpose)

The other interface is eth0 and is connected via the router. This is the interface that is to have no restrictions on it at all.

When I use iptables iptables -i eth1 -A INPUT -j DROP. I cannot get a network connection when this rule is in use. The webserver on the box allows no connection and email is not collected, Even though eth1 is specified. Could this be because the system is trying to use eht1 over eth0, if so how can I tell thesystem to use eth0?

Just to be clear:

Eth0 Protected network connection. No constraints or controls are needed.
Eth1 Snort interface, connected to DMZ, needs stealth


Thanks

Michael
 
Old 12-26-2003, 04:56 PM   #2
Mara
Moderator
 
Registered: Feb 2002
Location: Grenoble
Distribution: Debian
Posts: 9,537

Rep: Reputation: 149Reputation: 149
How does your 'route' result look like? Maybe eth1 is your default interface, not eth0?
 
Old 12-26-2003, 05:15 PM   #3
MaverickApollo
Member
 
Registered: Oct 2003
Distribution: Debian
Posts: 55

Original Poster
Rep: Reputation: 15
Yes, it does look like eth1 is the default interface.

Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 * 255.255.255.0 U 0 0 0 eth1
192.168.1.0 * 255.255.255.0 U 0 0 0 eth1
169.254.0.0 * 255.255.0.0 U 0 0 0 eth1
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default inetpoint 0.0.0.0 UG 0 0 0 eth1

How do I cahnge it?

Last edited by MaverickApollo; 12-26-2003 at 05:16 PM.
 
Old 12-26-2003, 07:13 PM   #4
MaverickApollo
Member
 
Registered: Oct 2003
Distribution: Debian
Posts: 55

Original Poster
Rep: Reputation: 15
When I try and add a route with eth0 it states that "Network Unreachable". When I unplug the cable thats attached to eth1, there is no connection at all.

Any one have any ideas whats happening here????
 
Old 12-26-2003, 09:44 PM   #5
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
Are you trying to put two NICs on the same subnet, by any chance?
 
Old 12-27-2003, 06:39 AM   #6
MaverickApollo
Member
 
Registered: Oct 2003
Distribution: Debian
Posts: 55

Original Poster
Rep: Reputation: 15
they are both using 255.255.255.0 eth0 ip is 192.168.1.5 and eth1 is 192.168.1.4

If I was to put them on different subnets it would not work would it? The rest of the network is using a subnet of 255.255.255.0.

I have just tried to put eth1 on subnet 255.255.0.0 and it keeps the routing table as:


Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 * 255.255.255.0 U 0 0 0 eth0
169.254.0.0 * 255.255.0.0 U 0 0 0 eth1
192.168.0.0 * 255.255.0.0 U 0 0 0 eth1
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default inetpoint 0.0.0.0 UG 0 0 0 eth0

BUT: When I apply the IPTables it will not block off ports and does not stealth the box. I am using this rule: iptables -i eth1 -A INPUT -j DROP.

The IP 192.168.1.4 (Eth1)replys to pings from the other subnet without having to set a static route on the router, but refuses to block off using iptables. Do I have to add something else to the rule?

Last edited by MaverickApollo; 12-27-2003 at 07:32 AM.
 
Old 12-28-2003, 03:13 PM   #7
Mara
Moderator
 
Registered: Feb 2002
Location: Grenoble
Distribution: Debian
Posts: 9,537

Rep: Reputation: 149Reputation: 149
Quote:
Originally posted by MaverickApollo
they are both using 255.255.255.0 eth0 ip is 192.168.1.5 and eth1 is 192.168.1.4

If I was to put them on different subnets it would not work would it? The rest of the network is using a subnet of 255.255.255.0.
It won't work this way..What you can do is
1) use different subnets for the cards and leave 255.255.255.0 netmask
2) divide 192.168.1.0/255.255.255.0 into two subnets, one for every interase (requires change of one of the IPs)

Could you tell us what you're trying to do with this config?
 
Old 12-28-2003, 04:19 PM   #8
dubman
Member
 
Registered: Jan 2003
Distribution: Redhat 9, Fedora Core 1, Suse 8
Posts: 188

Rep: Reputation: 30
Mara is absolutley correct. The Linux Stack will not allow multi-homing of interfaces (unless you are load-balancing, in which case both NICs have the same IP). If two NICs are in the same subnet, Linux will only use one of the interfaces to respond, reguardless of which interface the request came in on. Which can obviously casue problems. Time for some networking 101. Seperate your networks and enable routing if you need to communicate between them.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Red Hat 7.3 and multiple gateways on multiple interfaces bluefmc Linux - Networking 2 11-19-2004 05:01 PM
Iptables firewall in multiple lan interfaces Neelesh Linux - Security 3 07-31-2004 01:19 PM
Multiple Ethernet Interfaces gjs286 Linux - Networking 1 04-19-2004 01:09 PM
dchpd, multiple interfaces Robert0380 Linux - Networking 4 05-13-2003 11:57 AM
netfilter iptables and multiple interfaces raypen Linux - Networking 1 07-23-2002 09:07 PM


All times are GMT -5. The time now is 03:49 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration