Re: [SLUG] Multiple interfaces in iptables rules

[David Kempe <dave@xxxxxxxxxxxxxxxxxxxxx>]

Damn Pete,
just use shorewall :)

dave

Peter Hardy wrote:
> Peter Hardy wrote:
> > But I'd like a rule to apply to my eth0 and eth1 interfaces while 
> > ignoring all other ethernet interfaces. Rusty's Packet Filtering 
> > HOWTO doesn't specify any syntax for it. It's not possible to give 
> > multiple -i or -o flags, and splitting it in to seperate rules for 
> > each interface is awkward at best.
> >
> > I've tried comma separated interfaces by running `iptables -A INPUT 
> > -i eth0,eth1 -j LOG`, but it doesn't log any traffic to eth0, so I'm 
> > guessing iptables is looking for an interface named "eth0,eth1". And, 
> > of course, space separating the interface names just gives a bad 
> > argument error.
> >
> > So, is it possible to have iptables match two or more interfaces in a 
> > single rule?
>
> For the benefit of the archives, I solved this by marking packets 
> based on the interface criteria, and then matching on marks.
>
> As an example, my multi-homed gateway previously had a number of rules 
> like these to filter traffic routed between the local networks.
>  $IPT -A FORWARD -m state --state NEW -m tcp -p tcp -i $OFFICE_IFACE 
> -o ! $INET_IFACE -j tcp_local
>  $IPT -A FORWARD -m state --state NEW -m tcp -p tcp -i ! $INET_IFACE 
> -o $OFFICE_IFACE -j tcp_local
>
> My question came up because I'm about to attach another Internet link 
> to it, and wanted it excluded from the above rules just like 
> $INET_IFACE is above.
>
> The solution I'm trialling is to mark all incoming packets like so:
>  # Packets arriving from external links are marked 1
>  $IPT -t mangle -A PREROUTING -i $INET_IFACE1 -j MARK --set-mark 1
>  $IPT -t mangle -A PREROUTING -i $INET_IFACE2 -j MARK --set-mark 1
>
>  # Packets departing on an external link are marked 2
>  $IPT -t mangle -A PREROUTING -o $INET_IFACE1 -j MARK --set-mark 2
>  $IPT -t mangle -A PREROUTING -o $INET_IFACE2 -j MARK --set-mark 2
>
> Then my jump rules become:
>  $IPT -A FORWARD -m state --state NEW -m tcp -p tcp -m mark ! --mark 2 
> -i $OFFICE_IFACE -j tcp_local
>  $IPT -A FORWARD -m state --state NEW -m tcp -p tcp -m mark ! --mark 1 
> -o $OFFICE_IFACE -j tcp_local