Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 14 Mar 2003 06:53:07 -0500 (EST)
From:      "Dan Mahoney, System Admin" <danm@prime.gushi.org>
To:        questions@freebsd.org, <isp@freebsd.org>
Subject:   DNS Proxying based on source address
Message-ID:  <20030314031614.J60636-100000@prime.gushi.org>

next in thread | raw e-mail | index | archive | help
Hi all,

I'm doing a project where I want users on a wireless lan to be routed to a
single, wildcard A record, where they will be forced to input some
registration information, and then allowed out into the real world.  Some
nice folks at southwestern university have already written a project that
does this called "NetReg" but they are requiring a reboot of the client
machine and changes to the DHCP lease file.  (which will be stopped and
started while the client reboots)

(re:any potentia lecture on wi-fi security, I know there's risks that can
be done with mac-spoofing, but let's assume I'm aware of them).  Let's
also make sure we know this is in the dealer's room at a convention where
you have a lot of pissed off dealers who can't sell their stuff to a lot
of people if this doesn't work, so it's in everyone's best interest not to
tamper with it.  Let's even assume I'm bringing a 24 port switch just in
case something stupid DOES happen.  Back to our story...)

My solution is a bit more elegant, I think, but I'm stuck on one part.

Upon bootup, a person is given a DNS server on the local net.  The DNS
server is configured with a single wildcard record that returns the reg
server for any address.  everything else is blocked by the default ipfw
rule.

If they feel like trying to go to a site by ip, then they run into the
issue I'm having.

As far as they know, trying to reach anywhere will yield nothing, because
unassigned addresses will be firewalled from all but the netreg server.
(I'm running this on a gateway machine).  They can access the registration
page on the netreg machine, and once they register, the ipfw rules for
their machine are added, and a static mac-based lease for the ip they were
assigned is added in dhcpd.conf (which receives periodic reboots, every 30
minutes or so, instead of every minute with the netreg solution).

I'm going to have the netreg server add a rule like so:

ipfw add 100 fwd 192.168.1.2,53 any from <theirip> to
<192.168.1.1:53>

.1 and .2 are ips on the same interface (the one internal to the LAN).
Since these are on the local machine, the .2 dns server will still see the
original address, and will reply directly.  This will cause them to
magically now receive "normal" DNS replies, instead of the "bogus" ones.

At least in theory.

**Now here's the issue.**

Assuming I can get all this to work, if bob's windows pc sends a request
to 192.168.1.1, and 192.168.1.2 answers, will the machine ignore it?  If
so, how do I rewrite the source address on the outbound reply packets?

The same thing goes with http traffic.  I'd love to thwart anyone trying
to access a site via IP in teh same manner, but if they try to go to
http://google's.ip.address, will their machine pay any attention if a
reply comes back from my local http server on 192.168.1.1?

I know in a corporate lan scenario where you have a webserver with an
internal ip and an external ip, you run two different dns servers on two
different interfaces.  I guess what I need is a DNS server that will proxy
requests to either of two other DNS servers based on the machine making
the query.

**big question**

Would adding a second address to the loopback device to the system (and
only having the rules fwd to those addresses) solve the source-ip dilemma?
(at least for the DNS, for the http the machine is still expecting a reply
from some ip that is blocked).  Is there any way you all can think of to
have the server return a page when the user tries to access a site via IP
(ala a transparent proxy).

Any ideas, guys?

I know this may be too complicated for the freebsd-questions list.  I'm
corssposting this to isp- for that reason.

--

"You're a thucking reyer!"

-Richard Bozzello, who believed tongue piercing was painless.

--------Dan Mahoney--------
Techie,  Sysadmin,  WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144   AIM: LarpGM
Site:  http://www.gushi.org
---------------------------



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030314031614.J60636-100000>