Package: ipmasq
Version: 3.1.3
Hi,
As the /etc/ipmasq/rules/*.def show, I used to have rules like
# local interface, local machines, going anywhere is valid
$IPFWADM -I -a accept -V `ipofif $int` -S `ipofif $int`/`nmofif $int` -D
0.0.0.0/0
The problem comes when you have a largish number of rules,
like I do. I prefer to close down all access to my machine on the
internet side, and only allow packets in on selected ports from known
sources. This makes for a large number of rules, and the effect of
making two or three calls to ipofif and nmofif per rule was
significantly bogging down the time taken to set up the wall.
Add to the fact that the ipmasq script is supposed to be run
on every dialup (and I have diald, this means every few minutes,
maybe).
Since we do not need to call the ipofif more than once per
session, certainly not a couple of times every rule, this slowdown is
preventable. I have come up with a method of only calling the ipofif
and nmofif once per if per session. I suggest that this be made the
default for the debian ipmasq package.
I came up with this A01interfaces.rul (I propose this become
the installed standard), which gathers the interface data, and stores
the IP and the NM of the interfaces (using eval) once and for
all. Also submitted here is an example excerpt from one of my .rul
file showing how this can be used (I'll be willing to give modified
version of all the *.def files if needed).
Note how eval is used to pass the IP and NM information for
the interfaces to the other rules.
======================================================================
#!/bin/sh
# find interface names
EXTERNAL=`default-if`
INTERNAL=`enumerate-if | grep -v lo`
if [ -n "$EXTERNAL" ]; then
for ext in $EXTERNAL; do
INTERNAL=`echo $INTERNAL | sed -e s/$ext//`
done
fi
# set up the ip and netmasq of all the interfaces
if [ -n "$EXTERNAL" ]; then
for ext in $EXTERNAL; do
IPOFIF=$(ipofif $ext)
NMOFIF=$(nmofif $ext)
eval "IPOFIF_$ext=$IPOFIF"
eval "NMOFIF_$ext=$NMOFIF"
echo "Getting addresses for external $ext: IP=$IPOFIF NM=$NMOFIF"
done
fi
if [ -n "$INTERNAL" ]; then
for int in $INTERNAL; do
IPOFIF=$(ipofif $int)
NMOFIF=$(nmofif $int)
eval "IPOFIF_$int=$IPOFIF"
eval "NMOFIF_$int=$NMOFIF"
echo "Getting addresses for internal $int: IP=$IPOFIF NM=$NMOFIF"
done
fi
======================================================================
I30internal.rul excerpt (the real file is looong, and also,
dissemination os a security breach ;-)
======================================================================
if [ -n "$INTERNAL" ]; then
for int in $INTERNAL; do
ext='';
eval "IPOFIF_INT=\$IPOFIF_$int"
eval "NMOFIF_INT=\$NMOFIF_$int"
echo "I30internal rules $IPFWADM int=$int";
case $MASQMETHOD in
ipfwadm)
# local interface, local machines, going anywhere is valid
$IPFWADM -I -a accept -V $IPOFIF_INT -S $IPOFIF_INT/$NMOFIF_INT -D
0.0.0.0/0
[SNIP]
if [ -n "$EXTERNAL" ]; then
for ext in $EXTERNAL; do
echo "I30internal rules $IPFWADM int=$int ext=$ext"
eval "IPOFIF_EXT=\$IPOFIF_$ext"
eval "NMOFIF_EXT=\$NMOFIF_$ext"
# remote interface, claiming to be local machines, IP
# spoofing, get lost
$IPFWADM -I -a deny -V $IPOFIF_EXT -S $IPOFIF_INT/$NMOFIF_INT -D
0.0.0.0/0 -o
[SNIP]
done
fi
;;
ipchains)
# local interface, local machines, going anywhere is valid
$IPCHAINS -A input -j ACCEPT -i $int -s $IPOFIF_INT/$NMOFIF_INT
if [ -n "$EXTERNAL" ]; then
for ext in "$EXTERNAL" ; do
echo "I30internal rules $IPFWADM int=$int ext=$ext"
eval "IPOFIF_EXT=\$IPOFIF_$ext"
eval "NMOFIF_EXT=\$NMOFIF_$ext"
# remote interface, claiming to be local machines, IP
# spoofing, get lost
$IPCHAINS -A input -j DENY -i $ext -s $IPOFIF_INT/$NMOFIF_INT -o
[SNIP]
done
fi
;;
esac
done
fi
======================================================================
-- System Information
Debian Release: slink
Kernel Version: Linux tiamat 2.0.35 #1 Fri Jul 17 13:07:56 CDT 1998 i486 unknown
Versions of the packages ipmasq depends on:
ii netbase 3.11-1 Basic TCP/IP networking binaries
--
"To IBM, 'open' means there is a modicum of interoperability among
some of their equipment." Harv Masterson
Manoj Srivastava <[EMAIL PROTECTED]> <http://www.datasync.com/%7Esrivasta/>
Key C7261095 fingerprint = CB D9 F4 12 68 07 E4 05 CC 2D 27 12 1D F5 E8 6E
