Re: IPtables and RIP

Kenneth Goodwin wrote:

>If you know the ip addresses of the legitimate RIP ICMP sources, then
>configure
>the firewall rulesets to just allow the ICMP packets from those sources
>instead of the world.
>
That is quite hard since the subnetwork is pretty big with many 
gateways. It'd take a lot of time to figure out which ones are valid and 
to get them all. With incomplete redirection information you run the 
risk of some packets not reaching their destination at all...

>You can throw Iptables into logging mode for RIP packets only (see MAN
>iptables, etc)
>
I know that, and that's what's happening already. The thing that made me 
really ask this question was that in the logging info the original RIP 
packet which triggered the redirect to be sent was shown at the end, 
enclosed in square brackets. I am wondering if I can access that 
information also - it'd make my life a lot easier :)

Here is an example:

Mar 30 21:57:28 big-two kernel: LOGGED PACKET: IN=eth0 OUT= 
MAC=00:50:da:4f:4a:7b:00:05:00:67:b4:08:08:00 SRC=1.1.173.195 
DST=1.1.170.52 LEN=56 TOS=0x00 PREC=0x00 TTL=63 ID=59714 PROTO=ICMP 
TYPE=5 CODE=1 GATEWAY=1.1.172.1 [SRC=1.1.170.52 DST=1.1.171.255 LEN=72 
TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=UDP SPT=520 DPT=520 LEN=52 ]

Note: first two numbers of the IP adresses are changed to 1.1 for 
privacy reasons. The box' IP addy is 1.1.170.52.
For clarity here's the box' network information, taken from ifconfig, 
first 2 numbers changed to 1.1:
inet addr:1.1.170.52  Bcast:1.1.171.255  Mask:255.255.254.0

It was created by a normal "-j LOG" action. As you can see at the end is 
the original RIP packet sent out by the box. I do not know where it got 
this information from. If someone can tell me and if I can access it 
I'll be a lot closer to a satisfying solution. What I really hope is 
that a line like
iptables -A INPUT -p icmp --icmp-type 5 -m state RELATED -j ACCEPT
will do the trick. Can anyone confirm that (or smack me for saying 
something stupid)?

>and see the source IP addresses
>of the current RIP sources that way. Validate them and add those specific
>IP's as allowed
>for RIP and ICMP and deny for anyone else.
>  
>
No can do, because of the reasons mentioned above and the fact that if a 
gateway should be added or changed you have to keep patching the 
firewall script. Preferably the script should work without continuous 
patching (I'm being paid too little too spend much time on it ;) )

>remember Rule set order is important.
>
I know that, I'm quite familiar with ipchains/iptables but thanks for 
the hint :)

Greetings,
Eric.