Date: Fri, 14 Mar 2003 14:28:40 -0600 From: "Mark Johnston" <mjohnston@skyweb.ca> To: "'Dan Mahoney, System Admin'" <danm@prime.gushi.org> Cc: "'Tracy, John'" <tracy@covenant.edu>, <isp@freebsd.org> Subject: Re: DNS Proxying based on source address Message-ID: <005901c2ea68$4d4633e0$be0fa8c0@MJOHNSTON> In-Reply-To: <20030314133430.D39684-100000@prime.gushi.org>
next in thread | previous in thread | raw e-mail | index | archive | help
> Well, okay, you've overlooked the basic issue I'm having with > all of this. Yes, that was deliberate. I was trying to solve your problem rather than answer your question. :) From what I understand of your situation, messing around with DNS isn't necessary. Most things that people will want to do require TCP, so it seems reasonable to allow unrestricted UDP access. For instance, when an unregistered user boots up and heads to a web site, they'll resolve its real IP address, but the browser will still wind up with the registration page. The security hole involved in permitting UDP traffic seems comparable to the security hole inherent in the idea of trusting local users based on IP address. [snip] > reasonable, and what we want. But because there's no in-place > connection, I STRONGLY SUSPECT that the responses will go more like > > alias ip port 53 - - - > client machine. I'm afraid I don't have a spare box to test your suspicion on at the moment; you are probably better placed to find out for sure one way or another than I am. I only tested it personally using TCP. [snip] > this is the kicker, and the question I was asking about. Won't most > clients ignore the udp traffic if it's coming from an ip they didn't > make the request of? Remember, these are both reachable ip addresses > bound to ed0 or whatnot. Would I need not only an: > > ipfw add fwd 192.168.1.2,53 from authorizedclientip/32 to mainip:32 > > but also some means of rewriting the source address of those reply > packets? Yes, DNS clients should ignore traffic they didn't specifically request. The response needs to come from the same port and address that the request was addressed to. [snip] > Those are my thoughts. Has anyone here successfully proxied DNS using > ipfw fwd? I have not tried this; if you're bent on using fwd on your DNS traffic, some testing should clear up your questions regarding ports and IPs. Mark > > > > It sounds like transparent "proxying" is exactly what you > > > want. Here's > > > > my take on a solution for you - some parts of it I've > tested for a > > > > similar scheme, some parts are speculation. > > > > > > > > First off, please reread the paragraph of ipfw(8) > starting with "fwd > > > > ipaddr[,port]", just for reference. > > > > > > > > I'd start with an ipfw rule like the following, on the gateway: > > > > > > > > ipfw add 65000 fwd $GATEWAY tcp from $INTERNAL to any > > > > > > > > That grabs all incoming TCP traffic and redirects it to > > > your own box. > > > > This part I've tested before, in conjunction with > Apache - any web > > > > request, no matter the destination IP, will get a > response from your > > > > httpd. Other TCP traffic will hit your box and receive > a RST or no > > > > response, depending on your firewall rules. If you want to > > > get fancy, > > > > you can listen for other protocols and send custom messages. > > > > > > > > Once you've got that rule into place, it's pretty > > > straightforward to add > > > > rules to allow/NAT/whatever traffic on an IP-by-IP basis > > > for hosts that > > > > you want to let out: > > > > > > > > ipfw add 64900 allow tcp from $REGISTERED_IP to any > > > > > > > > and so on. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?005901c2ea68$4d4633e0$be0fa8c0>