How can iptables distinguish between packets coming in from one route versus another?

Ulysses_ · 10-21-2018, 01:59 AM

If packets are coming in through different interfaces eth1 and eth2, iptables can distinguish them with something like

-i eth1

If they are coming in through the same interface eth1 but from different servers at 10.0.0.2 and 10.0.0.3, they can be distinguished with something like

-s 10.0.0.2/32

What if packets originate from unknown IP's and subnets and pass through different gateways and all that you know is the IP of each of the gateways, 192.168.1.1 and 192.168.1.2, and that all packets come in through eth1?

lazydog · 10-21-2018, 07:14 PM

All packets sent over the internet or any network for that matter have a source and destination address. With this information every device knows how to send the packet on to it's final destination.

Ulysses_ · 10-22-2018, 01:40 AM

But we do not know the source IP, and it can be the same source IP sending packets in both paths, how can we write an iptables command line at the receiving end that distinguishes one path from another, for example to drop packets from one path? If there were two nic's at the receiving end, one for each path, we'd write -i eth1. But there is only one.

rknichols · 10-22-2018, 08:18 AM

Ahhh, same server (source), different routes. If they are coming in from a different immediate upstream router, you could use the source MAC. Otherwise, you might be able to distinguish the routes by the remaining TTL when the packets are received. That's going to be hard to implement and probably unreliable, but I don't know of any other way that the same packets arriving by different routes would differ.

lazydog · 10-22-2018, 12:37 PM

Not sure I understand your question 100%. What exactly are you trying to accomplish? Are you trying to block traffic from an unknown source or are you trying to only allow certain traffic from an unknown source?

Ulysses_ · 10-22-2018, 02:06 PM

Looks like buying an nic is the best option. It's kinda complicated and open-ended what I am trying to accomplish (related to load balancing and smartphones) and I wouldn't be good at explaining it.

lazydog · 10-22-2018, 05:05 PM

A second NIC might not be the best option. Whatever you plan on doing on the second NIC you should be able to do on the first one too. It all comes down to what you are trying to accomplish.