lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <1351413193.2740.10.camel@andylaptop> Date: Sun, 28 Oct 2012 08:33:13 +0000 From: Andrew Beverley <andy@...ybev.com> To: Kristian Evensen <kristian.evensen@...il.com> Cc: netdev@...r.kernel.org, netfilter@...r.kernel.org Subject: Re: Prioritizing IPs on interface with multiple addresses On Mon, 2012-10-22 at 11:36 +0200, Kristian Evensen wrote: > Hello, > > I am currently working on configuring an embedded system that will be > used as an access point for other devices. In order to reduce the > number of external devices, we want to connect the LAN on the embedded > system to a switch. Then, two separate networks will also be connected > to this switch, and the LAN interface assigned one IP from each > network. The IPs are static and network addresses are not overlapping. > One interface is the main interface for all traffic from clients, > while the other is used as fallback and for some monitoring traffic. > The clients that connect to this AP will be assigned IPs using DHCP > and traffic from them will be NAT'ed. > > Initially, this setup works fine. The devices connected to this AP are > able to send traffic through the intended network and to the correct > hosts. If I disconnect from the main network, the routing tables are > updated and traffic is routed through the secondary network. However, > when I connect to the main network again, things break. The problem is > that there is an inconsistency between the order in the routing table > and the order of IP addresses assigned to the interface, which causes > problems when I do NAT (MASQUERADE). The default route (with the > lowest metric) points to the main network, but the first IP address > belongs to the secondary network. So what happens is that the packets > have the MAC-address of the first hop in the main network, but a > source IP address from the second network (chosen by the NAT). This > causes the traffic to be discarded by the network. Deleting (and then > later adding) the IP of the secondary network is not an option as it > is needed for the monitoring traffic. I have to admit that I'm struggling to get my head round this, and I suspect others are as well given lack of replies. Could you provide an ascii diagram and either write more succinctly or try and simplify the problem you are having? > My question is, is there some way to prioritize the different IP > addresses assigned to an interface? For example, is there an > equivalent to a metric, index or something similar? That said, I don't know if there is any way of doing this. Can you not achieve it with iptables rules and SNAT? > Based on my > understanding, ip addr is only able to append addresses. Well it can delete them as well, or have I misunderstood? > Another soulution would be to monitor network events and create/delete > SNAT rules on-demand, but this is a big hack if you ask me and I would > like to try to avoid it. Ah, you've already thought of SNAT. Is there not a way of doing it without adding and deleting rules? For example can you use packet marking somehow? Andy -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists