0

I have the following setup:

  • PC eth0 connected to GW eth1
  • GW eth0 is connected to the internet.

GW has net.ipv4.ip_forward=1 in sysctl.conf

So, when I simply run (in GW):

iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE

PC gains internet access. And when I want to disable it, I just run (in GW):

itpables -t nat -F

My problem is with established connections, they are not cancelled.. Example:

  • GW: run iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
  • PC: open http://ip-api.com/ in browser
  • GW: run iptables -t nat -F
  • PC: refresh browser -> page is refreshed!!

If I try a different page in PC it doesn't work, but due to HTTP Connection: Keep-Alive functionality, the browser can still use that established connection..

I could simply disable net.ipv4.ip_forward but I don't want to do that because of the rest of my setup.
So what I would like is to be able to get iptables (or linux NAT modules) to mess up their connection tracking so those connections become invalid or dropped...

Or is it possible to specify in iptables rules if connection established before TIMESTAMP -j DROP (so I could add that rule before the MASQUERADE)?

Improve this question
1
  • There's a utility called 'cutter' IIRC that will RST TCP connections you specify.
    – LawrenceC
    Feb 29, 2016 at 1:19

1 Answer 1

Reset to default
1

example: iptables -A INPUT -p tcp -s 0/0 --sport 513:65535 -d 202.54.1.20 --dport 22 -m state --state NEW,ESTABLISHED -m time --timestart 09:00 --timestop 18:00 --days Mon,Tue,Wed,Thu,Fri -j ACCEPT

So if you add -m time --timestart 09:00 --timestop 18:00 --days Mon,Tue,Wed,Thu,Fri -j ACCEPT to your rule it will be time sensitive.

You will need to specify another rule to kill RELATED,ESTABLISHED traffic.

iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE -m time --timestart 09:00 --timestop 18:00 --days Mon,Tue,Wed,Thu,Fri -j ACCEPT
#if it not between these times the next rule will drop the traffic
iptables -t nat -I POSTROUTING -o eth0 -j DROP
iptables -A INPUT -m conntrack -j ACCEPT  --ctstate RELATED,ESTABLISHED -m time --timestart 09:00 --timestop 18:00 --days Mon,Tue,Wed,Thu,Fri -j ACCEPT
iptables -A INPUT -m conntrack -j DROP  --ctstate RELATED,ESTABLISHED
Improve this answer
5
  • Could you elaborate on this relating it to my question? I cannot see how it helps as, to my understanding, this will match current time in the system and not the time the connection was established...
    – Filipe Pina
    Feb 26, 2016 at 10:30
  • I have added rules above. It compares the packet time against the system time. If it is NOT between the times listed the RELATED,ESTABLISH connections will be dropped.
    – cybernard
    Feb 26, 2016 at 22:32
  • Yes, but unless I misunderstood it, it will drop looking at packet time, not at the time connection (for that packet) was established so it doesn't solve my problem...
    – Filipe Pina
    Feb 28, 2016 at 21:38
  • You did misunderstand. If the time, not the packet time, is after timestop the traffic is dropped. It doesn't matter when the connection was established, at 18:00 hours it WILL be dropped. PERIOD
    – cybernard
    Feb 28, 2016 at 23:30
  • Exactly, so I did understand. This does not answer my question.
    – Filipe Pina
    Feb 29, 2016 at 7:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .