Hello,
I appreciate all the comments, Let's keep it up. I promise I'll post the whole
thing when I have it all figured out. My mental picture is slowly filling out.
Three specific things I've got to know though: (diagrams are just for reference)
> > LAN
> > | (172...)
> > | (eth1)
> > _/\__/\_ +---+----+ _/\__/\_
> > / \ (63...) | | (204...) / \
> > ( Internet )-----------+ Router +----------( Internet )
> > \_ __ _/ (eth0) | | (eth2) \_ __ _/
> > \/ \/ +----+---+ \/ \/
> > (eth3)| 63..
> > | 204..
> > |
> > --+---------------+----------+-- <---single physical
> > | | net
> > | | (i.e. one hub)
> > | |
> > +---+---+ 63..1 +---+---+ 63..2
> > | Linux | 63..4 | Linux | 63..3
> > +-------+ 204..1 +-------+ 204..2
> > 204..4 204..3
.---------------------------------------------------------------.
|Version| IHL |Type of Service| Total Length |
|-------+-------+---------------+-------------------------------|
| Identification |Flags| Fragment Offset |
|---------------+---------------+-------------------------------|
| Time to Live | Protocol | Header Checksum |
|---------------+---------------+-------------------------------|
| Source Address |
|---------------------------------------------------------------|
| Destination Address |
`---------------------------------------------------------------'
1. If I modify the TOS field on incomming packets with IPchains, and then route
those packets to the proper internal server on my protected network, when that
server replies, what do the TOS fields in the reply packets look like? Are they
copies of the ones that came from the outside initiating the connection routed
through my router? (I hope that's the case) Or does the kernel on the replying
machine invent some new TOS value for those packets?
2. On a machine with two IP addresses on the same nic (A and B). If someone on
the internet makes a connection to IP address A. What is the source address of
reply packets in the IP header diagram above? A? (I hope that's the case too.)
3. Finally, is it necessary for the router box above to have two addresses on
the internal network. Does it matter that the default gateway that packets,
having a 204.. source address, go to might be a 63.. address? (or vice versa, as
long as all machines are connected to the same physical network) If it doesn't
then there is no need for a second IP address on the internal side of the router
(eth3 above). If it does matter, can I put in some fancy next-hop routes on the
servers based on what the source address of reply packets ends up being? (This
would essentially completely ignore the default route)
Something to remember (it may or may not matter to you): Valid packets coming in
on eth2 (204... above) will have a 204... destination address. Also Valid
packets coming in on eth0 (63... above) will have a 63... destination address.
Marking the packets as they come in is merely so that we can route them back on
the same interface they came in on. I don't want assymetric routes.
Here's some more ascii art:
local
process
| ^
eth0 \ | | / eth0
eth1 | | | | eth1
eth2 +--incomming | | outgoing--+ eth2
eth3 | packets | | packets | eth3
etc. / | | \ etc.
| | | ^
| | | |
| | | |
| ---------------------------|-|-----------------(lo interface)<----|
| | | | |
| V V | _______ _______ |
---> C --> S --> ______ --> D --> ~~~~~~~~ -->|forward|---->| |-------
h a |input | e {Routing } |Chain | |output |ACCEPT
e n |Chain | m {Decision} |_______| --->|Chain |
c i |______| a ~~~~~~~~ | | ->|_______|
k t | s | | | | |
s y | q local v | | |
u | V e process DENY/ | | v
m | DENY/ r packets REJECT | | DENY/
| V REJECT a | | | REJECT
| DENY d --------------------- |
V e -----------------------------
DENY
I've slightly modified the packet flow diagram from the ipchains howto according
to my understanding of how things work (in other words, correct me if I'm
wrong). What I want to know is what the packet looks like once it gets to the
routing decision block above from a local process. (Assume that this packet is a
response to a connection established from the internet. I alredy know how the
source address is decided upon for connections originating from a machine. This
is farely well documented on page 48 of the IP command reference, which is part
of the iproute2 distribution.) I especially want to know what the source and
destination addresses are at this point. I'm sure you all can see why. If not
let me know and I'll clarify.
Thanks again for the help and comments.
-- Andrew
depaan@xxxxxxxxxxxxx
--------------------------------------------------------------
Want answers to life's big questions? Visit www.bibleinfo.com.
