Greetings,
I am trying to get a host to reject pings with an ICMP host-unreachable
message so that it looks like the host doesn't exist. This is easy and
works nicely.
The problem is that I'd like to use SNAT to spoof the source address so
that the ICMP looks like it is coming from the network's gateway, not
the stealthy host. This isn't working the way I expected.
I've set up a very simple test rig for this.
192.168.1.1 (GATEWAY) <-----> 192.168.1.2 (STEALTH)
|
\--> 192.168.1.3 (WORKSTATION)
The stealth host is running a very simple "firewall" whose only purpose
is to block pings and respond with a host-unreachable alleging to be
from the gateway:
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -F -t nat
iptables -F -t filter
iptables -X
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -p icmp --icmp-type \
host-unreachable -j SNAT --to 192.168.1.1
iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request \
-j REJECT --reject-with icmp-host-unreachable
iptables -A INPUT -i eth0 -p all -j ACCEPT
From STEALTH I can ping anywhere (good). From WORKSTATION I can ping
anywhere except STEALTH which returns "host unreachable" (good) BUT the
message is reported as coming from 192.168.1.2 (bad). I've looked at
the packets in detail using wireshark and they really do say that they
are coming from STEALTH instead of GATEWAY.
It looks like the SNAT is doing nothing at all. What am I missing?
Thanks,
Gary
--
==============================================
Trilunar Consulting http://www.trilunar.ca/
==============================================
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
