coldwizard
Regular Contributor
Hi
Some configurations containing multiple LAN networks (either multiple routers or a inside VPN server) are having problems with connections between the local networks and devices on the private network of the gateway router.
A fix to this problem is to completely delete the INVALID checking rule from the FORWARD chain by using a /jffs/script.
This fixes that problem, but also stops the sanity checks for possible hacking attempts, for example packet with a bad TCP flag combination.
I am trying to make a rule that gives the security check for packets from the Internet (eth0) while allowing the connection between devices on the local networks.
Although I have two routers configured to give me a LAN with multiple networks, I cannot get it to fail.
I was hoping that someone that has the problem, could run the following script manually which would put the rule back in until a reboot, but to only check packets from the Interface eth0.
Please reply with
(1) Confirm that you had to remove the rule because of the problem above.
(2) If this rule works (or not) for your connectivity tests.
(3) Any new problems caused by this rule.
(4) Ideas on anything in your configuration that may explain why I cannot duplicate the problem.
Some configurations containing multiple LAN networks (either multiple routers or a inside VPN server) are having problems with connections between the local networks and devices on the private network of the gateway router.
A fix to this problem is to completely delete the INVALID checking rule from the FORWARD chain by using a /jffs/script.
This fixes that problem, but also stops the sanity checks for possible hacking attempts, for example packet with a bad TCP flag combination.
I am trying to make a rule that gives the security check for packets from the Internet (eth0) while allowing the connection between devices on the local networks.
Although I have two routers configured to give me a LAN with multiple networks, I cannot get it to fail.
I was hoping that someone that has the problem, could run the following script manually which would put the rule back in until a reboot, but to only check packets from the Interface eth0.
Code:
#!/bin/sh
#
InsLoc1=`iptables -nvL FORWARD --lin | grep -i "INVALID" | tail -n 1 | awk '{ print $1 }'`
if [ "x$InsLoc1" == "x" ]
then
echo "Rule INVALID not found"
# Add rule to Drop unexpected traffic from Internet interface only
iptables -I FORWARD 1 -i eth0 -m state --state INVALID -j DROP
InsLoc1=1
else
echo "rule INVALID replaced at $InsLoc1"
# Replace rule with one changed to drop unexpected traffic from Internet interface only
iptables -D FORWARD $InsLoc1
iptables -I FORWARD $InsLoc1 -i eth0 -m state --state INVALID -j DROP
fi
#Please reply with
(1) Confirm that you had to remove the rule because of the problem above.
(2) If this rule works (or not) for your connectivity tests.
(3) Any new problems caused by this rule.
(4) Ideas on anything in your configuration that may explain why I cannot duplicate the problem.
do we? ). It also scales nicely for multiple WAN interfaces, needing only one rule per active WAN interface.
