1

Let me start by stating my final goal: When traffic comes in on a specific IP address, if the server isn't on, turn it on with Wake On Lan. I am using a TP-Link Archer C7 v2 router with DD-WRT installed with build r30709.

  • WOL works
  • Logging LAN traffic on port works (via iptables rule)
  • Pinging server from script to see if on after parsing for custom log entry works
  • sending WOL works from script
  • Logging WAN traffic does NOT work (via iptables rule)

Now from what I have seen about DD-WRT is a lot of people seem to create VLANs when they do something like that. My router is Atheros based, and DD-WRT supposedly doesn't support VLAN for Atheros routers although many people seem to have gotten it working on this router (they don't post instructions online).

So I am currently researching a way to setup the port on the router the server is plugged into on its own VLAN, but so far no luck.

Here are my two iptables rules:

#this works
iptables -I FORWARD -i br0 -p tcp --dport 32400 -m state --state NEW -j LOG --log-prefix "PLEX LAN Connection "

# this does not work 
iptables -I FORWARD -i eth0 -p tcp --dport 32400 -m state --state NEW -j LOG --log-prefix "PLEX WAN Connection "

# this does not work either (dd-wrt.com says vlan2 is the WAN interface)
iptables -I FORWARD -i vlan2 -p tcp --dport 32400 -m state --state NEW -j LOG --log-prefix "PLEX WAN Connection "

Is this something that can be corrected with just iptables? Because I cannot get iptables to log incoming WAN connections on that port to /var/log/messages. I assumed it wasn't writing to the log because it's not sitting on its own VLAN.

Update 1

Please note, I tried using eth0 instead of vlan2, but same result: nada in log. I even removed -i <interface> all together in both rules, but never anything on WAN traffic.

root@DD-WRT:~# ip a
root@DD-WRT:~# ip ro
default via pu.bl.ic.1 dev eth0
pu.bl.ic.0/24 dev eth0  proto kernel  scope link  src pu.bl.ic.ip
127.0.0.0/8 dev lo  scope link
169.254.0.0/16 dev br0  proto kernel  scope link  src 169.254.255.1
192.168.1.0/24 dev br0  proto kernel  scope link  src 192.168.1.1

According to DD-WRT website, vlan2 is supposed to represent the logical interface for the WAN.

Update 2

I noticed the destination IP is incorrect. Should be going to 192.168.1.2 but it.s going to 192.168.0.10. That is not a valid LAN at all:

Oct  4 20:47:35 DD-WRT kern.warn kernel: [114429.460000] PLEX LAN Connection IN=br0 OUT=eth0 MAC=XXXXXXXXXXXXXXXXXXX SRC=192.168.1.133 DST=192.168.0.10 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=45163 DF PROTO=TCP SPT=4644

Tried this as the only rule per suggestion below:

iptables -A FORWARD -p tcp --dport 32400 -m limit --limit 50/min -j LOG --log-prefix "CHECK INTERFACES"

Still nothing in the log; stopped logging LAN connections too.

Update 3

root@DD-WRT:/tmp/var/log# iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 2742 packets, 395K bytes)
 pkts bytes target     prot opt in     out     source               destination
   13   764 DNAT       tcp  --  *      *       0.0.0.0/0            pu.bl.ic.ip       tcp dpt:14619 to:192.168.1.2:32400
    0     0 DNAT       icmp --  *      *       0.0.0.0/0            pu.bl.ic.ip       to:192.168.1.1
    4   232 DNAT       tcp  --  *      *       0.0.0.0/0            pu.bl.ic.ip       tcp dpt:22709 to:192.168.1.2:32400
  220 19942 TRIGGER    0    --  *      *       0.0.0.0/0            pu.bl.ic.ip       TRIGGER type:dnat match:0 relate:0

Chain INPUT (policy ACCEPT 30145 packets, 2802K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 253 packets, 21491 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 260 packets, 21863 bytes)
 pkts bytes target     prot opt in     out     source               destination
 1065 67674 SNAT       0    --  *      eth0    192.168.1.0/24       0.0.0.0/0           to:pu.bl.ic.ip
   10   624 MASQUERADE  0    --  *      *       0.0.0.0/0            0.0.0.0/0           mark match 0x80000000/0x80000000

migrated from serverfault.com Oct 4 '16 at 21:23

This question came from our site for system and network administrators.

  • 1
    Can you please add the output of ip a and ip ro ? – Sanael Oct 4 '16 at 19:53
  • You don't have an interface named vlan2, you only have 3 interfaces, eth0, lo and br0. The -i flag on iptables will only work with those 3, unless you create more. Your public interface is eth0, as you can see from the routing information you updated. – Andrew Domaszek Oct 4 '16 at 20:05
  • Agreed. Which is why I started with eth0 on the -i flag. However that didn't do anything. Reading the dd-wrt website, they mention multiple times vlan2 is the WAN logical interface. So I tried it. But again, my original rule was/is -i eth0. I will update the post to reflect that. – Nathan Oct 4 '16 at 20:08
  • 1
    I'd try iptables - A FORWARD -p tcp --dport 32000 -m limit --limit 50/min -j LOG --log-prefix "CHECK INTERFACES" to see which interface is used as the WAN one. You don't need the new state to diagnose. Then tail -f -n 50 /var/log/messages or something. – Sanael Oct 4 '16 at 20:21
  • 1
    So the issue is in the routing part. Could you post the output of iptables -t nat -L -n -v and verify that the client is not sending the packet to the wrong ip ? Although if the destination is in the 192.168.1.0/24 subnet, the traffic won't go through eth0 but through br0. – Sanael Oct 4 '16 at 21:09
1

I can't add comment on superuser, so it's an answer. Can you confirm that the service is working, whatever you access it from LAN or WAN ?

Do you use an iptables script, or do you just execute your command in bash separately ? If you don't have an iptables script, as Cybernard said, you have to make sure your LOG line is before the ACCEPT one.

Once a packet is ACCEPTed or DROPped, it leaves the chain, so will never match the log rule located later in the chain.

For example, to insert your LOG rule as the first one in the FORWARD chain :

iptables -I FORWARD 1 -p tcp --dport 32400 -m limit --limit 50/min -j LOG --log-prefix "CHECK INTERFACES"
  • Yes, the service works fine. It's a Plex media server. I setup a manual port forward on my router as well as enabled uPNP so it's auto configured. The service works great. As far as the iptables rule. I added it via the DD-WRT admin-->commands window and clicked save firewall. The only firewall rule there is the one posted in this answer. When I am connected on my LAN wifi, your rule logs perfectly. When I disable wifi and use my cell service. Plex operates great still, but I get no logging. Starting to think it's DD-WRT's fault and I need to switch. – Nathan Oct 5 '16 at 18:26
  • For whatever reason, switching to OpenWRT from DD-WRT made this work. The rules were correct, just something witth DD-WRT. – Nathan Oct 9 '16 at 23:13
0

please note that the ip on the WAN interface will be pre nat so the router might be the target even if packet is forwarded. this is what i would do:

iptables -I INPUT -p any -i <wan interface> -j LOG --log-prefix "FIREWALL-WAN"
iptables -I FORWARD -p any -i <wan interface> -j LOG --log-prefix "FIREWALL-WAN"

where is the interface with the wan ip. normally i just drop wan trafic and then permit what i want, so in fact i would not do this.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.