New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
firewall service: respect marks in rpfilter #39054
Conversation
This allows one to add rules which change a packet's routing table: iptables -t raw -I PREROUTING 1 -m set --match-set myset src -j MARK --set-mark 2 ip rule add fwmark 2 table 1 priority 1000 ip route add default dev wg0 table 1 to the beginning of raw table PREROUTING chain, and still have rpfilter.
@@ -123,7 +123,7 @@ let | |||
# Perform a reverse-path test to refuse spoofers | |||
# For now, we just drop, as the raw table doesn't have a log-refuse yet |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This comment is out-of-date if you check line 134.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, I thought of getting rid of it too -- will do.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It is a bit strange that nixos does rpfilter with netfilter since Linux already check reverse path with net.ipv4.conf.all.rp_filter
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
cc @andir
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
IMO this is fine. Using validmark
shouldn't cause any (additional) trouble.
I don't think it is an issue using the rpfilter mod in conjunction with the sysctl. It is the only option for IPv6 anyway.
Any news on this? If this is still relevant it would be nice to get it into 18.09. |
Motivation for this change
This allows one to add rules which change a packet's routing table:
to the beginning of raw table PREROUTING chain, and still have rpfilter. One use case is routing packets to specific IP addresses through other network interface (I use this to route packets to hosts blocked in Russia through VPN).
Things done
build-use-sandbox
innix.conf
on non-NixOS)nix-shell -p nox --run "nox-review wip"
./result/bin/
)