I have a problem where all external requests are logged or interpreted like they are originating from the router as the log shows shows the routers ip rather then the originating clients IP. I'm trying to work out where/why/how external requests been masqueraded as routers internal ip address?!?!

I'm using a dlink router with DD-WRT v24-sp2 (06/08/12) std. I also have in my conf several firewall rules cause I use my routers wifi connection and have 2 separate wlans.

iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT

I doubt they are the root of my troubles. If anybody had a similar problem please share experiences. Tnx in advance.

  • Can you advise what the interfaces are, so we can see which is the internal and which is the external interface ? It sounds, from the problem description that you are applying SNAT rules on the wrong interface in the line 'iptables -t nat -I POSTROUTING -o br0 -j SNAT --to nvram get lan_ipaddr" – davidgo Mar 5 '13 at 19:03
  • Well I've been followin this tutorial on howto enable separate wlans. dd-wrt.com/wiki/index.php/Multiple_WLANs The br1 bridge consists of the following adapters ath1 (the public wlan) and br0 has ath0 ( the private wlan ) and eth0 (the private lan). The wan interface is eth1. – Gorjan Mar 6 '13 at 15:29

Your problem is with the rule

iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`

This rule is rewriting packets leaving br0 [ ie one of your WIFI interfaces ], presumably with the address of the router.

I'm not entirely sure what this rule is trying to achieve ? I suspect you may be able to comment it out and things will work as intended.

  • I can confirm this. This line was suggested as such in the tutorial to unable traffic beeing routed out of br0 to pass to the internet so br1 had connection, but was not necessary in may cas (the case being separating wifi networks from each other and still maintaining internet connection on both) – Gorjan Apr 3 '13 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.