netdev - Re: What's the right way to use a *large* number of source addresses?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 24 May 2014 11:13:45 -0400
From:	Jamal Hadi Salim <jhs@...atatu.com>
To:	Richard Weinberger <richard.weinberger@...il.com>
CC:	Niels Möller <nisse@...thpole.se>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	Jonas Bonn <jonas@...thpole.se>
Subject: Re: What's the right way to use a *large* number of source addresses?

On 05/24/14 10:44, Richard Weinberger wrote:

> How to use this?
> My tc's manpage does not know anything about nat.
>

Start writing one and i will help.

> Maybe I'm mistaken but IIRC all non-netfilter nat code has been removed.
>

This is stateless nat nothing to do with netfilter (much more 
efficient). Here's some documentation for you ;->
----
hadi@...-1:~$ $TC filter add $DEV parent ffff: protocol ip u32 match ip 
dport 8080 0xffff flowid 1:1 action nat help
Illegal nat construct (help)
Usage: ... nat NAT
NAT := DIRECTION OLD NEW
DIRECTION := { ingress | egress }
OLD := PREFIX
NEW := ADDRESS
bad action parsing
parse_action: bad value (2:nat)!
Illegal "action"
-----

Google will give you more examples, but here's one:

Lets add a rule on the public facing bridge:

hadi@...-1:~$ $TC filter add dev virb0 parent ffff: protocol ip u32 
match ip dport 8080 0xffff flowid 1:1 action nat ingress 
192.168.10.15/32 10.0.0.15/32


now display it:
hadi@...-1:~$ $TC -s filter ls dev virbr0 parent ffff: protocol ip
filter pref 49152 u32
filter pref 49152 u32 fh 800: ht divisor 1
filter pref 49152 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:1
   match 00001f90/0000ffff at 20
	action order 1:  nat ingress 192.168.10.15/32 10.0.0.15 pass
         installed 96 sec used 96 sec	Action statistics:
	  Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0)
	  backlog 0b 0p requeues 0

You will need to add a reverse translation for internal->external

etc

cheers,
jamal

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html