I'm writing some fairly complex firewall rules, which will be
controllable through a GUI. The basic requirement is:
1. The user can select whether or not to allow some traffic.
2. Traffic the user has opted to disallow, will be directed at a
transparent proxy, if there is a suitable proxy, otherwise it will be
dropped. This is done by setting a MARK on the traffic and applying
special routing to it.
I can obviously construct rules to make a decision about
allowing/blocking traffic and apply them to the FORWARD chain in the
filter table. However, the rules to make a decision about what gets
sent to the transparent proxy are almost identical to the filtering
rules, but iptables only lets you MARK in the mangle table - this means
I need to duplicate all the filter rules into the mangle table, which
seems like a very inefficient way of doing things when there are a large
number of rules.
Doing any kind of filtering in the mangle table seems to be strongly
discouraged, so I'm looking for some advice on the best way to approach
this. What are the problems associated with either filtering in the
mangle table's PREROUTING chain, or at least just having mangle rules to
MARK packets that are to be allowed and then rules in the filter table
that allow/drop based on that MARK?
From looking at
https://upload.wikimedia.org/wikipedia/commons/thumb/3/37/Netfilter-packet-flow.svg/2000px-Netfilter-packet-flow.svg.png
it looks like:
- mangle:PREROUTING will carry both INPUT and FORWARD traffic, so care
would need to be taken to ensure the rules are acting on the right traffic.
- mangle:PREROUTING rules won't be able to use -o, whereas
filter:FORWARD could.
- mangle:PREROUTING will happen before any NAT, so some traffic would
have the "wrong" addresses on it.
Secondly, am I right in thinking that a MARK that affects routing needs
to be set in mangle:PREROUTING - i.e. by the time mangle:FORWARD is
traversed, its too late?
Thanks.
--
- Steve Hill
Technical Director
Opendium Limited http://www.opendium.com
Direct contacts:
Instant messager: xmpp:steve@xxxxxxxxxxxx
Email: steve@xxxxxxxxxxxx
Phone: sip:steve@xxxxxxxxxxxx
Sales / enquiries contacts:
Email: sales@xxxxxxxxxxxx
Phone: +44-1792-824568 / sip:sales@xxxxxxxxxxxx
Support contacts:
Email: support@xxxxxxxxxxxx
Phone: +44-1792-825748 / sip:support@xxxxxxxxxxxx
begin:vcard
fn:Steve Hill
n:Hill;Steve
org:Opendium Limited
adr:1 Brue Close;;Highfield House;Bruton;Somerset;BA10 0HY;England
email;internet:steve@xxxxxxxxxxxx
title:Technical Director
tel;work:+44-1792-824568
x-mozilla-html:FALSE
url:http://www.opendium.com
version:2.1
end:vcard
