/* HINT: Search archives @ http://www.indyramp.com/masq/ before posting! */
Message forwarded to masq mailing list for Todd Sabin <[EMAIL PROTECTED]>...
Hi,
I've been having a problem with 2.2.14 and masquerading UDP, DNS
particularly. I've figured out what's going wrong, but I'm not sure
what the "right" way to fix it is.
The high level description of the problem is that if you have multiple
external interfaces, then it's possible that UDP packets may be
masqueraded with the wrong external IP addr, provided that you send
multiple packets with the same source addr/port but different dest
addr.
A concrete example (made up addresses):
On the masquerading machine:
internal interface eth0 on 192.168.0.1/24
external interface ppp0 on 10.0.0.1/8
external interface sl0 on 172.16.0.1/16
(masquerading 192.168.0.0/24)
On internal machine, 192.168.0.2 you run named, and configure it to
use a fixed source port, 4444.
The internal named tries to contact a DNS server at 10.0.0.5, so it
sends out a packet from 192.168.0.1:4444 to 10.0.0.5:53. That gets
masqueraded as 10.0.0.1:61001, say.
Now, before the above masquerade entry expires, the named tries to
contact a DNS server at 172.16.0.5, so it send out a packet from
192.168.0.1:4444 to 172.16.0.5:53.
Here's where the problem comes in. The masquerading server checks for
an existing masq entry, and since this is UDP, it allows it to match
if only the source addr/port match. So it finds the masq entry to
10.0.0.5, and then uses that. The result is that it sends a packet
out sl0, but with a src IP address of 10.0.0.1. Naturally this
doesn't work.
So, what's the fix for this? I modified ip_fw_masquerade() in
ip_masq.c as follows, which seems to have solved the problem fine for
me, but it breaks the sysctl_ip_dynaddr stuff that follows, so it's
not exactly a real solution.
ms = ip_masq_out_get_iph(iph);
+ if (ms!=NULL && ms->maddr != maddr) {
+ ip_masq_put (ms);
+ ms = NULL;
+ }
if (ms!=NULL) {
Anyone have thoughts on this?
Todd
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
Admin requests can be handled at http://www.indyramp.com/masq-list/ -- THIS INCLUDES
UNSUBSCRIBING!
or email to [EMAIL PROTECTED]
PLEASE read the HOWTO and search the archives before posting.
You can start your search at http://www.indyramp.com/masq/
Please keep general linux/unix/pc/internet questions off the list.
