-
Notifications
You must be signed in to change notification settings - Fork 27
/
README
213 lines (184 loc) · 10.5 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
iptables-trace
This software allows tracing a packet through the linux kernels netfilter
tables.
It is meant to assist in debugging and writing iptables rules.
THIS SOFTWARE DOES NOT WORK WITH iptables-over-nftables.
USE xtables-monitor --trace for iptables-over-nftables.
xtables-monitor --trace
1 TRACE: 2 fc475095 raw:PREROUTING:rule:0x3:CONTINUE -4 -t raw -A PREROUTING -p icmp -j TRACE
2 PACKET: 0 fc475095 IN=lo LL=0x3040000000000000000000000000800 SRC=127.0.0.1 DST=127.0.0.1 LEN=84 TOS=0x0 TTL=64 ID=38349DF
3 TRACE: 2 fc475095 raw:PREROUTING:return:
4 TRACE: 2 fc475095 raw:PREROUTING:policy:ACCEPT
5 TRACE: 2 fc475095 filter:INPUT:return:
6 TRACE: 2 fc475095 filter:INPUT:policy:DROP
7 TRACE: 2 0df9d3d8 raw:PREROUTING:rule:0x3:CONTINUE -4 -t raw -A PREROUTING -p icmp -j TRACE
INSTALLATION
Install
* python-libnetfilter
* libnetfilter-log
* python-iptables
and run iptables-trace
OPERATION
iptables-trace is rather limited in the arguments you can provide.
If possible (supported by kernel) use --bpf, --bpf "host example.org" will
trace packets in both directions, which is currently not possible using --source or --destination.
--limit can be used to limit the amount of traced packets to 1 packet per second.
The output looks like:
IN=vif0 OUT= SRC=1.1.1.1 DST=2.2.2.2 LEN=40 TOS=0x00 PREC=0x00 TTL=61 ID=58730 PROTO=TCP SPT=45331 DPT=80 # iptables LOG like formatting of the packet
...
raw PREROUTING # table chain
ACCEPT # policy
mangle PREROUTING (#3) # table chain (rule number)
ip 1.1.0.0/255.255.0.0 -> 0.0.0.0/0.0.0.0 # rule
=> MARK {'set-xmark': '0x100/0x100'} # action taken
...
GUTS
iptables-trace creates additional rules in the raw table.
These rules are used to set a TRACE target on packets you are interested in.
The logging of these TRACE messages is retrieved using libnetfilter_log.
By parsing the TRACE messages, the table, chain and action is retrieved.
python-iptables is used to lookup the iptables rule and format it for display.
The rules in the raw table are deleted upon program exit.
EXAMPLES
On a router/firewall, a typical output will look like this:
IN=vif2 OUT= SRC=1.1.1.1 DST=2.2.2.2 LEN=60 TOS=0x00 PREC=0x00 TTL=43 ID=4997 PROTO=TCP SPT=34419 DPT=22
raw PREROUTING
ACCEPT
mangle PREROUTING
ACCEPT
nat PREROUTING
ACCEPT
mangle FORWARD
ACCEPT
filter FORWARD (#31)
ip 0.0.0.0/0.0.0.0 -> 0.0.0.0/0.0.0.0 set:{'match-set': 'profile:server-terminal dst'}
=> server-terminal:filter
filter server-terminal:filter (#8)
tcp 0.0.0.0/0.0.0.0 -> 0.0.0.0/0.0.0.0 mark:{'! mark': '0x100/0x100'} tcp:{'dport': '22'}
=> ACCEPT
mangle POSTROUTING
ACCEPT
nat POSTROUTING
ACCEPT
You can see all matching rules for the packet and the actions taken.
In case of NAT, you'll see the modifications to the packet in nat/POSTROUTING.
IN=vif0 OUT= SRC=10.5.1.7 DST=1.1.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=61 ID=48889 PROTO=ICMP TYPE=8 CODE=0
raw PREROUTING
ACCEPT
mangle PREROUTING (#4)
ip 10.0.0.0/255.0.0.0 -> 0.0.0.0/0.0.0.0
=> MARK {'set-xmark': '0x100/0x100'}
mangle PREROUTING (#11)
ip 0.0.0.0/0.0.0.0 -> 0.0.0.0/0.0.0.0 mark:{'mark': '0x100/0x100'} set:{'match-set': 'profile:client-normal src'}
=> client-normal:mangle
mangle client-normal:mangle (#1)
return
mangle PREROUTING
ACCEPT
nat PREROUTING
ACCEPT
mangle FORWARD
ACCEPT
filter FORWARD (#12)
ip 0.0.0.0/0.0.0.0 -> 0.0.0.0/0.0.0.0 set:{'match-set': 'profile:client-normal src'}
=> client-normal:filter
filter client-normal:filter (#10) /* allow icmp */
icmp 0.0.0.0/0.0.0.0 -> 0.0.0.0/0.0.0.0 mark:{'mark': '0x100/0x100'}
=> ACCEPT
mangle POSTROUTING
ACCEPT
nat POSTROUTING (#6)
ip 10.5.1.0/255.255.255.0 -> 0.0.0.0/0.0.0.0
=> SNAT {'to-source random persistent': '', 'to-source': '2.2.2.2-2.2.2.3', 'to-source random': ''}
In case a fwmarks are used for routing decisions, you can see the iptables setting the mark:
IN=vif0 OUT= SRC=1.1.1.1 DST=2.2.2.2 LEN=40 TOS=0x00 PREC=0x00 TTL=61 ID=58730 PROTO=TCP SPT=45331 DPT=80
raw PREROUTING
ACCEPT
mangle PREROUTING (#3)
ip 1.1.0.0/255.255.0.0 -> 0.0.0.0/0.0.0.0
=> MARK {'set-xmark': '0x100/0x100'}
mangle PREROUTING (#10)
ip 0.0.0.0/0.0.0.0 -> 0.0.0.0/0.0.0.0 mark:{'mark': '0x100/0x100'} set:{'match-set': 'profile:client-restricted src'}
=> client-restricted:mangle
mangle client-restricted:mangle (#1) /* proxy mark */
tcp 0.0.0.0/0.0.0.0 -> 0.0.0.0/0.0.0.0 mark:{'mark': '0x100/0x100'} tcp:{'dport': '80'}
=> MARK {'set-xmark': '0x1/0x1'}
mangle client-restricted:mangle (#2)
return
mangle PREROUTING
ACCEPT
mangle FORWARD
ACCEPT
filter FORWARD (#1)
ip 0.0.0.0/0.0.0.0 -> 0.0.0.0/0.0.0.0 state:{'state': 'RELATED,ESTABLISHED'}
=> ACCEPT
mangle POSTROUTING
ACCEPT
But it can assist in writing local rules as well.
Not considering tunnels, a packet will traverse the filters/chains as outlined in the simplified diagram:
+---------------------+ +-----------------------+
| NETWORK INTERFACE | | NETWORK INTERFACE |
+----------+----------+ +-----------------------+
| ^
| |
| |
v |
+---------------------+ |
| PREROUTING | |
+---------------------+ |
| | |
| +-----------------+ | |
| | raw | | |
| +--------+--------+ | |
| v | |
| +-----------------+ | +----------+------------+
| | conn. tracking | | | POSTROUTING |
| +--------+--------+ | +-----------------------+
| v | | |
| +-----------------+ | | +-------------------+ |
| | mangle | | | | source NAT | |
| +--------+--------+ | | +-------------------+ |
| v | | ^ |
| +-----------------+ | | +--------+----------+ |
| | destination NAT | | | | mangle | |
| +-----------------+ | | +-------------------+ |
+----------+----------+ +------------------------+ +-----------------------+
| | FORWARD | ^
| +------------------------+ |
v | | |
+-------------+ | +--------+ +--------+ | |
| QOS ingress +----->| | mangle +->| filter | |------------>+
+------+------+ | +--------+ +--------+ | |
| | | |
| +------------------------+ |
| |
| |
v |
+---------------------+ +----------+------------+
| INPUT | | OUTPUT |
+---------------------+ +-----------------------+
| | | |
| +---------------+ | | +-----------------+ |
| | mangle | | | | filter | |
| +-------+-------+ | | +-----------------+ |
| v | | ^ |
| +---------------+ | | +-------+---------+ |
| | filter | | | | destination NAT | |
| +---------------+ | | +-----------------+ |
+----------+----------+ | ^ |
| | +-------+---------+ |
| | | mangle | |
| | +-----------------+ |
| | ^ |
| | +-------+---------+ |
| | | conn. tracking | |
| | +-----------------+ |
| | ^ |
| | +-------+---------+ |
| | | raw | |
| | +-----------------+ |
| +-----------------------+
v ^
+--------------------------------------------------------------- +------------+
| LOCAL PROCESS |
+-----------------------------------------------------------------------------+