Showing posts with label nat. Show all posts

Monday, September 5, 2011

implementation prerouting and postrouting

The DNAT target is used to do Destination Network Address Translation, which means that it is used to rewrite the Destination IP address of a packet. If a packet is matched, and this is the target of the rule, the packet, and all subsequent packets in the same stream will be translated, and then routed on to the correct device, host or network. This target can be extremely useful, for example,when you have a host running your web server inside a LAN, but no real IP to give it that will work on the Internet. You could then tell the firewall to forward all packets going to its own HTTP port, on to the real web server within the LAN. We may also specify a whole range of destination IP addresses, and the DNAT mechanism will choose the destination IP address at random for each stream. Hence, we will be able to deal with a kind of load balancing by doing this.

Source NAT

If you want to "hide" the private LAN 192.168.0.0/24 "behind" one address 10.5.8.109 given to you by the ISP, you should use the source network address translation (masquerading) feature of the MikroTik router. The masquerading will change the source IP address and port of the packets originated from the network 192.168.0.0/24 to the address 10.5.8.109 of the router when the packet is routed through it.
To use masquerading, a source NAT rule with action 'masquerade' should be added to the firewall configuration:

/ip firewall nat add chain=srcnat action=masquerade out-interface=Public

All outgoing connections from the network 192.168.0.0/24 will have source address 10.5.8.109 of the router and source port above 1024. No access from the Internet will be possible to the Local addresses. If you want to allow connections to the server on the local network, you should use destination Network Address Translation (NAT).

Destination NAT

If you want to link Public IP 10.5.8.200 address to Local one 192.168.0.109, you should use destination address translation feature of the MikroTik router. Also if you want allow Local server to talk with outside with given Public IP you should use source address translation, too.
Add Public IP to Public interface:

/ip address add address=10.5.8.200/32 interface=Public

Add rule allowing access to the internal server from external networks:

/ip firewall nat add chain=dstnat dst-address=10.5.8.200 action=dst-nat \
	to-addresses=192.168.0.109

Add rule allowing the internal server to talk to the outer networks having its source address translated to 10.5.8.200:

/ip firewall nat add chain=srcnat src-address=192.168.0.109 action=src-nat \
	to-addresses=10.5.8.200

1:1 mapping

If you want to link Public IP subnet 11.11.11.0/24 to local one 2.2.2.0/24, you should use destination address translation and source address translation features with action=netmap.

/ip firewall nat add chain=dstnat dst-address=11.11.11.1-11.11.11.254 \
	action=netmap to-addresses=2.2.2.1-2.2.2.254

/ip firewall nat add chain=srcnat src-address=2.2.2.1-2.2.2.254 \
	action=netmap to-addresses=11.11.11.1-11.11.11.254

Port mapping

If you would like to direct requests for a certain port to an internal machine (sometimes called opening a port, port mapping), you can do it like this:

/ip firewall nat add chain=dstnat dst-port=1234 action=dst-nat protocol=tcp to-address=192.168.1.1 to-port=1234

This rule translates to: when an incoming connection requests TCP port 1234, use the DST-NAT action and redirect it to local address 192.168.1.1 and the port 1234

Saying How To Mangle The Packets

So now we know how to select the packets we want to mangle. To complete our rule, we need to tell the kernel exactly what we want it to do to the packets.

6.1 Source NAT

You want to do Source NAT; change the source address of connections to something different. This is done in the POSTROUTING chain, just before it is finally sent out; this is an important detail, since it means that anything else on the Linux box itself (routing, packet filtering) will see the packet unchanged. It also means that the `-o' (outgoing interface) option can be used.
Source NAT is specified using `-j SNAT', and the `--to-source' option specifies an IP address, a range of IP addresses, and an optional port or range of ports (for UDP and TCP protocols only).

## Change source addresses to 1.2.3.4.
# iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4

## Change source addresses to 1.2.3.4, 1.2.3.5 or 1.2.3.6
# iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4-1.2.3.6

## Change source addresses to 1.2.3.4, ports 1-1023
# iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 1.2.3.4:1-1023

Natting a network range with NETMAP+Iptables

Some times we need to do a 1 to 1 NAT of a network range depending upon a condition (the destination network for example).
For example, you have the 192.168.1.0/24 network and you would like to NAT each IP to its equivalent in 192.168.2.0/24 when the packet travels through the NAT device.
If you use Netfilter as a NAT device or gateway you can use the NETMAP module like this :



iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.1.1.0/24 -j NETMAP --to 192.168.2.0/24

In the example above, the source address 192.168.1.100 will become 192.168.2.100 while traversing the gateway.
I think that’s clear enough

NETMAP target

Linux Packet Filtering and iptables
Prev	Chapter 11. Iptables targets and jumps	Next

11.11. NETMAP target

NETMAP is a new implementation of the SNAT and DNAT targets where the host part of the IP address isn't changed. It provides a 1:1 NAT function for whole networks which isn't available in the standard SNAT and DNAT functions. For example, lets say we have a network containing 254 hosts using private IP addresses (a /24 network), and we just got a new /24 network of public IP's. Instead of walking around and changing the IP of each and every one of the hosts, we would be able to simply use the NETMAP target like -j NETMAP -to 10.5.6.0/24 and voila, all the hosts are seen as 10.5.6.x when they leave the firewall. For example, 192.168.0.26 would become 10.5.6.26.

The Problem

You have a corporate LAN. You want to set up a VPN (in this case OpenVPN) into the LAN for your road-warriors. However, your LAN is numbered with one of the very common private subnets, such as 192.168/16. Your road-warriors often get addresses in the same private subnet from their coffee-shops, and this breaks things horribly. This is illustrated in the diagram below.
I'm going to use specific IP addresses and interface names on this page, since too often I find when people try to describe the general solution it actually makes it less clear and harder to apply to your own network.

NAT detection

NAT detection is the process of determining hosts running Network Address Translators (NATs).

[hide]

Approaches

Active detection

Port scanning

Some software NAT solutions (such as Kerio WinRoute Firewall), as well as many hardware solutions, provide a control port, which allows users to monitor and control their server (e.g. using a web browser). These control ports can be easily detected by means of port scanning (see Nmap).

Routing test

Some improperly configured NATs allow IP packets to be translated from an external network. Routing test can detect these translators by trying to contact external server (e.g.forensicswiki.org:80) with modified routing tables.

Passive detection

IP TTL

Network Address Translators decrement IP TTL values of all translated packets.

Overview

Unauthorized NAT (Network Address Translation) devices can be a significant security problem. Typically the NAT device will appear to the network administrator as an end host and it will authenticate itself onto the network. However, the NAT device provides unrestricted access to any number of hosts connecting to it directly, or more troublingly via wireless (Wi-Fi 802.11). Wi-Fi is a particular problem since it allows access to the network from a considerable distance, allowing unauthorized access without even entering the building.
Reliably detecting NAT devices is difficult since they are virtually indistinguishable from legitimate hosts. This paper describes how the detailed, pervasive, traffic monitoring capabilities of sFlow (RFC 3176) can be used to identify NAT devices on a network.

IP NAT -Network Address Translation

IP Network Address Translation (IP NAT) For Internet Connectivity solution for small network to business network, or even as a basic design of large enterprise.

Designing the Internet connectivity for your organization, you should define how large the size of your network infrastructure is.

For small such as home network or SOHO, non-routed networks you may be able to use a simple IP NAT solution, this solution will provide a minimum security.
For larger, medium to large-sized networks will require an ISA server or hardware firewall solution such as Cisco ASA 5500 series. This will allow multiple routed networks to be connected to the internet and provide more advanced security and control of resources access

Some networking manufacturers introduces any types of security appliances such as D-Link DSD-150 for home network, or Check Point Secure@Office series for Medium-sized business.

What is IP NAT?

IP NAT is a primary method to enable computers in the private network with unregistered IP addresses to access the public network – the Internet. IP NAT functions as an intermediary between a client computer on an unregistered network and the Internet. For each packet generated by a client, the IP NAT implementation substitutes a registered address for the client’s unregistered address.

There are three basic types of IP NAT:

1. Static IP NAT,

IP NAT translates a number of unregistered IP addresses to an equal number of registered addresses so that each client always uses the same registered address.

IP NAT- static

This type of NAT does not conserve the IP address space because you need the same number of registered addresses as unregistered addresses. Static NAT is also not as secure as the other NAT types because each computer is permanently associated with a particular registered address, which makes it more possible for Internet intruders to direct traffic to a particular computer on your network using that registered address.

2. Dynamic IP NAT

Dynamic IP NAT is intended for circumstances in which you have fewer registered IP addresses than unregistered computers. Dynamic IP NAT translates each unregistered computer to one of the registered addresses. Intruders on the Internet are less able to associate a registered address with a particular computer (as in static IP NAT) because the registered address assigned to each client changes frequently. The main drawback of dynamic IP NAT is that it can support only the same number of simultaneous users as you have registered IP addresses available. If all the registered addresses are in use, a client attempting to access the Internet receives an error message.

IP NAT - dynamic

3. Masquerading IP NAT

Masquerading IP NAT translates all the unregistered IP addresses on your network using a single registered IP address. To enable multiple clients to access the Internet simultaneously, the NAT router uses port numbers to differentiate between packets generated by and destined to different computers. Masquerading provides the best security of the NAT types because the association between the unregistered client and the registered IP address/port number combination in the NAT router lasts only for the duration of a single connection.

IP NAT - Masquerading

IP NAT Security

Most IP NAT implementations today rely on the masquerading technique because it minimizes the number of registered IP addresses needed and it maximizes the security provided by IP NAT. Note, however, that IP NAT by itself, even using masquerading, is not a true firewall and does not provide ironclad security for high-risk situations. IP NAT effectively blocks unsolicited requests and other probes from the Internet, meaning that it thwarts intruders searching for unprotected file shares and private Web or FTP servers. However, NAT does not prevent users on the Internet from launching directed denial of service attacks against specific computers on the private network or from using other, more complex tactics to compromise your network.

Some IP NAT implementations include additional security capabilities, typically a technique called stateful packet inspection. Stateful packet inspection is a generic term for a process in which the IP NAT router examines the incoming packets from the Internet more carefully than usual. In a typical IP NAT implementation, the router is concerned only with the IP addresses and port numbers of the packets passing through it. An IP NAT router that supports stateful packet inspection examines other network and transport layer header fields as well, looking for patterns in various damaging behaviors, such as IP spoofing, SYN floods, and teardrop attacks. Various manufacturers implement stateful packet inspection in different ways, so not all IP NAT routers with this capability offer the same degree of protection.

IP NAT Solution

As previously discussed, the network infrastructure design decision should consider the following:

What is the size of the private network?
What are the security requirements for the organizations?

IP NAT is an appropriate solution if:

Internet access and access to the network is not restricted on a user-by-user basis
The private network consist of users in a non-routed environment
The organization requires private addressing for the computers on the private network

An IP NAT server requires at least two network interfaces.

Each interface requires an IP address. IP address range assigned must be within the range of addressed assigned to the network segment it is connected to.
Subnet mask must be the same as the subnet mask assigned to the network segment it is connected to.

An IP NAT Server can be placed on the network to perform certain tasks.

Isolate the network traffic to the source, destination, and intermediate network segments.
Create a screened subnet within the private network, protecting confidential data
Exchange network packets between dissimilar network segment types

In today wireless routers, almost all the manufacturers claim that their wireless products have the firewall capabilities of IP NAT and SPI (stateful packet inspection) such as Linksys wireless routers; D-Link wireless routers; Netgears wireless routers; Belkin wireless routers and others.

http://www.computer-network.net/ip-nat

Saturday, September 11, 2010

Configure soekris as a OpenBSD wireless NAT router.

I use a Soekris device, bought mine for € 70,- with a wireless network interface. (wi0)
Besides that interface, this "machine" has two other ports; sis0 going to the modem and sis1 is not used, but any computer may be connected.

How difficult would it be to use this machine as a router using OpenBSD? Not difficult at all!

First install your Soekris with OpenBSD.

Now login and configure a few things.
# vi /etc/rc.conf.local
# Start NTP, it syncs time and requires very little maintenance.
ntpd_flags="-s"
# Start a DNS server.
named_flags=
# Clients should receive an IP-address. DHCP will only listen on sis1 and wi0, the network
# interfaces where computers will connect on. Don't start DHCP on your "modem-port".
dhcpd_flags="sis1 wi0"
# Enable Packet Filter.
pf=
# Here are the rules for PF.
pf_rules=/etc/pf.conf

Configure named, the DNS server.

# cat /var/named/etc/named.conf
// $OpenBSD: named-simple.conf,v 1.9 2008/08/29 11:47:49 jakob Exp $
//
// Example file for a simple named configuration, processing both
// recursive and authoritative queries using one cache.

// Update this list to include only the networks for which you want
// to execute recursive queries. The default setting allows all hosts
// on any IPv4 networks for which the system has an interface, and
// the IPv6 localhost address.
//
acl clients {
localnets;
::1;
};

options {
version ""; // remove this to allow version queries

listen-on { any; };
listen-on-v6 { any; };

empty-zones-enable yes;

allow-recursion { clients; };
};

logging {
category lame-servers { null; };
};

// Standard zones
//
zone "." {
type hint;
file "etc/root.hint";
};

zone "localhost" {
type master;
file "standard/localhost";
allow-transfer { localhost; };
};

zone "127.in-addr.arpa" {
type master;
file "standard/loopback";
allow-transfer { localhost; };
};

zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" {
type master;
file "standard/loopback6.arpa";
allow-transfer { localhost; };
};

zone "lan.meinit.nl" {
type master;
file "master/lan.meinit.nl";
};

zone "wifi.meinit.nl" {
type master;
file "master/wifi.meinit.nl";
};

zone "1.168.192.in-addr.arpa" {
type master;
file "master/1.168.192.in-addr.arpa";
};

zone "2.168.192.in-addr.arpa" {
type master;
file "master/2.168.192.in-addr.arpa";
};

Now add all zones.

# cat lan.meinit.nl
$ORIGIN lan.meinit.nl.
$TTL 6h

@ IN SOA lan.meinit.nl. root.meinit.nl. (
1 ; serial
1h ; refresh
30m ; retry
7d ; expiration
1h ) ; minimum

NS soekris.lan.meinit.nl.
soekris A 192.168.1.1
32 A 192.168.1.32
33 A 192.168.1.33
34 A 192.168.1.34
35 A 192.168.1.35
36 A 192.168.1.36
37 A 192.168.1.37
38 A 192.168.1.38
39 A 192.168.1.39
40 A 192.168.1.40
41 A 192.168.1.41
42 A 192.168.1.42
43 A 192.168.1.43
44 A 192.168.1.44
45 A 192.168.1.45
46 A 192.168.1.46
47 A 192.168.1.47
48 A 192.168.1.48
49 A 192.168.1.49
50 A 192.168.1.50
51 A 192.168.1.51
52 A 192.168.1.52
53 A 192.168.1.53
54 A 192.168.1.54
55 A 192.168.1.55
56 A 192.168.1.56
57 A 192.168.1.57
58 A 192.168.1.58
59 A 192.168.1.59
60 A 192.168.1.60
61 A 192.168.1.61
62 A 192.168.1.62
63 A 192.168.1.63
64 A 192.168.1.64
65 A 192.168.1.65
66 A 192.168.1.66
67 A 192.168.1.67
68 A 192.168.1.68
69 A 192.168.1.69
70 A 192.168.1.70
71 A 192.168.1.71
72 A 192.168.1.72
73 A 192.168.1.73
74 A 192.168.1.74
75 A 192.168.1.75
76 A 192.168.1.76
77 A 192.168.1.77
78 A 192.168.1.78
79 A 192.168.1.79
80 A 192.168.1.80
81 A 192.168.1.81
82 A 192.168.1.82
83 A 192.168.1.83
84 A 192.168.1.84
85 A 192.168.1.85
86 A 192.168.1.86
87 A 192.168.1.87
88 A 192.168.1.88
89 A 192.168.1.89
90 A 192.168.1.90
91 A 192.168.1.91
92 A 192.168.1.92
93 A 192.168.1.93
94 A 192.168.1.94
95 A 192.168.1.95
96 A 192.168.1.96
97 A 192.168.1.97
98 A 192.168.1.98
99 A 192.168.1.99
100 A 192.168.1.100
101 A 192.168.1.101
102 A 192.168.1.102
103 A 192.168.1.103
104 A 192.168.1.104
105 A 192.168.1.105
106 A 192.168.1.106
107 A 192.168.1.107
108 A 192.168.1.108
109 A 192.168.1.109
110 A 192.168.1.110
111 A 192.168.1.111
112 A 192.168.1.112
113 A 192.168.1.113
114 A 192.168.1.114
115 A 192.168.1.115
116 A 192.168.1.116
117 A 192.168.1.117
118 A 192.168.1.118
119 A 192.168.1.119
120 A 192.168.1.120
121 A 192.168.1.121
122 A 192.168.1.122
123 A 192.168.1.123
124 A 192.168.1.124
125 A 192.168.1.125
126 A 192.168.1.126
127 A 192.168.1.127

# cat wifi.meinit.nl
$ORIGIN wifi.meinit.nl.
$TTL 6h

@ IN SOA wifi.meinit.nl. root.meinit.nl. (
1 ; serial
1h ; refresh
30m ; retry
7d ; expiration
1h ) ; minimum

NS soekris.wifi.meinit.nl.
soekris A 192.168.2.1
32 A 192.168.2.32
33 A 192.168.2.33
34 A 192.168.2.34
35 A 192.168.2.35
36 A 192.168.2.36
37 A 192.168.2.37
38 A 192.168.2.38
39 A 192.168.2.39
40 A 192.168.2.40
41 A 192.168.2.41
42 A 192.168.2.42
43 A 192.168.2.43
44 A 192.168.2.44
45 A 192.168.2.45
46 A 192.168.2.46
47 A 192.168.2.47
48 A 192.168.2.48
49 A 192.168.2.49
50 A 192.168.2.50
51 A 192.168.2.51
52 A 192.168.2.52
53 A 192.168.2.53
54 A 192.168.2.54
55 A 192.168.2.55
56 A 192.168.2.56
57 A 192.168.2.57
58 A 192.168.2.58
59 A 192.168.2.59
60 A 192.168.2.60
61 A 192.168.2.61
62 A 192.168.2.62
63 A 192.168.2.63
64 A 192.168.2.64
65 A 192.168.2.65
66 A 192.168.2.66
67 A 192.168.2.67
68 A 192.168.2.68
69 A 192.168.2.69
70 A 192.168.2.70
71 A 192.168.2.71
72 A 192.168.2.72
73 A 192.168.2.73
74 A 192.168.2.74
75 A 192.168.2.75
76 A 192.168.2.76
77 A 192.168.2.77
78 A 192.168.2.78
79 A 192.168.2.79
80 A 192.168.2.80
81 A 192.168.2.81
82 A 192.168.2.82
83 A 192.168.2.83
84 A 192.168.2.84
85 A 192.168.2.85
86 A 192.168.2.86
87 A 192.168.2.87
88 A 192.168.2.88
89 A 192.168.2.89
90 A 192.168.2.90
91 A 192.168.2.91
92 A 192.168.2.92
93 A 192.168.2.93
94 A 192.168.2.94
95 A 192.168.2.95
96 A 192.168.2.96
97 A 192.168.2.97
98 A 192.168.2.98
99 A 192.168.2.99
100 A 192.168.2.100
101 A 192.168.2.101
102 A 192.168.2.102
103 A 192.168.2.103
104 A 192.168.2.104
105 A 192.168.2.105
106 A 192.168.2.106
107 A 192.168.2.107
108 A 192.168.2.108
109 A 192.168.2.109
110 A 192.168.2.110
111 A 192.168.2.111
112 A 192.168.2.112
113 A 192.168.2.113
114 A 192.168.2.114
115 A 192.168.2.115
116 A 192.168.2.116
117 A 192.168.2.117
118 A 192.168.2.118
119 A 192.168.2.119
120 A 192.168.2.120
121 A 192.168.2.121
122 A 192.168.2.122
123 A 192.168.2.123
124 A 192.168.2.124
125 A 192.168.2.125
126 A 192.168.2.126
127 A 192.168.2.127

# cat 1.168.192.inaddr.arpa
$ORIGIN 1.168.192.in-addr.arpa.
$TTL 6h

@ IN SOA lan.home.meinit.nl. root.meinit.nl. (
1 ; serial
1h ; refresh
30m ; retry
7d ; expiration
1h ) ; minimum

NS soekris.lan.meinit.nl.
1 PTR soekris.lan.meinit.nl.
$GENERATE 32-127 $ PTR $.lan.meinit.nl.

# cat 2.168.192.in-addr.arpa
$ORIGIN 2.168.192.in-addr.arpa.
$TTL 6h

@ IN SOA wifi.meinit.nl. root.meinit.nl. (
1 ; serial
1h ; refresh
30m ; retry
7d ; expiration
1h ) ; minimum

NS soekris.home.meinit.nl.
1 PTR soekris.wifi.meinit.nl.
$GENERATE 32-127 $ PTR $.wifi.meinit.nl.

And setup the DHCP server.

# cat /etc/dhcpd.conf
subnet 192.168.1.0 netmask 255.255.255.0 {
option domain-name "lan.meinit.nl";
option domain-name-servers 192.168.1.1;
option routers 192.168.1.1;
range 192.168.1.32 192.168.1.127;
}
subnet 192.168.2.0 netmask 255.255.255.0 {
option domain-name "wifi.meinit.nl";
option domain-name-servers 192.168.2.1;
option routers 192.168.2.1;
range 192.168.2.32 192.168.2.127;
}

Finally configure your PF in /etc/pf.conf:

# wan is the interface to which the modem is connected.
wan = sis0
# This is an extra interface, not in use right now, but you could connect a cable.
lan = sis1
# This is the (Prism 2) wireless network card. Clients will connect to this interface mostly.
wifi = wi0

scrub in all

nat on $wan from !($wan) to any -> ($wan)

Now beter reboot to activate all changes. (Sure you could start every daemon by hand...)

Courtesy : http://meinit.nl/configure-soekris-openbsd-wireless-nat-router

e-maknyus