監看網路封包程式設計概說

作者: 邵文琳

前一個禮拜花了不少時間在看網路封包方面的程式設計 ..覺得十分有興趣.
感謝charles 和 ellery 的幫助 . 讓我觀念比較清楚 ...
在這裡我把我這一個星期的學習心得寫下來.
讓大家以後若有機會寫到類似程式時, 可是事半功倍 ..
網路程式設計方面相關資料很多 . 但是都是對比較上層的tcp,或udp的應用在做介紹.
對於網路層和datalink層面則著墨較少 .
所以"對我而言" 學習起來比較困難. 希望寫下這個對大家會有幫助.

一個網路封包監看程式 . 說穿了 只有四個重點:

第一 . 開啟一個可接收raw packet 的socket .
一般我們開始socket接收tcp或udp的packet 時, 我們收到的內容就直接是資料內容 .
kernel 己經幫我們把ethernet header 和 ip 或 arp header 都拿掉了.
但是在寫網路封包程式時, 我們需要header . 因此我們在開啟socket 的時候,就可以針對我們要收集的封包總類做過濾. 要求接收到的資料裡要包涵完整的封包標頭檔...

第二 . 有條件的接收封包和無條件的接收封包.
網路卡只會接收到ethernet header 的target mac 是自己的mac 時, 或接收到TARGET MAC 為 ff:ff:ff:ff:ff 的封包, 或是multicasting 的封包(也就是target ip是224開頭的封包 . 這種情況叫做 nonPromiscuous . 當我們要監看網路封包時,希望收到的不只是broadcast 或是 multicasting 或是自己的封包時, 我就要把網路卡設定成 Promiscuous . 如此一來我們就可以接到實體網路上的所有封包了...

第三 . filter 的設定.
當我們把網路卡設成 Promiscuous , 而且看到了所有封包header 時, 我們就可以依照我們自己的意思去過濾出我們想要的封包 . 可是一個問題來了 .. 網路上的封包那麼多.我們全都要一個個的去把它的標頭打開, 看看是不是自己要看的封包. 這樣做花的時間太長.以致於後面進來的封包都塞在buffer 裡, 等你一個個的檢查..我們需要一個filter 建立在硬體層和聯結層中建立一個filter , 先過濾出我們要的封包,再交由程式處理 . 這就是filter的功用．這種filter 是由bpf code 寫出來的! 不會寫bpf code ? 沒關係. 我們還是有別的方法把它變出來 ,,,,,

第四 . multiplexing I/O (blocking VS noblocking)
就如我們所知道的當我們在receving packet 時. 如果沒有資料進來, 程式就會等在那裡 ,這種情況叫做blocking , 但是有時候我們不想要無止限的等在那裡時, 郤又沒法把break 出來時,怎麼辦呢?使用signal 嗎? 另一種解決方式就是把資料流做unblocking.但unblocking 郤不能完成解決我的需求, 於是我利用到了 multiplexing I/O.接下來我在對以上四項做詳細解釋和範例:

第一 socket .
要如何開一個可以接收raw_data 的socket呢 ?

int sock;

// 開一個接收所有走ip protocol 封包的完整封包
sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_IP));

// 開一個接收所有走arp protocol 封包的完整封包
sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ARP));

// 開一個接收所有 protocol 封包的完整封包
sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_All));

// 在linux 下接收datalink 層的網路封包
sock = socket(PF_INET, SOCK_PACKET, htons(ETH+P_ALL));

PF_PACKET 支援兩個socket type:SOCK_RAW 和 SOCK_DGRAM, SOCK_RAW 會留下完整的 ethernet 標頭.SOCK_DGRAM 會去掉ETHERNET 標頭.但在linux 下使用PF_SOCK , SOCK_RAW 會有問題.最好是使用 PF_INET, SOCKET_PACKET 也可以留下完整的實體層的標頭.

第二 Promiscuous.
網路卡預設當然都是nonPromiscuous , 要變成 Promiscuous 必須對網卡做設定.在socket 己經open 下

#include
#include
struct ifreq ifrq;

strncpy(ethreq.ifr_name,"eth0",IFNAMSIZ);
ioctl(sock,SIOCGIFFLAGS,&ifrq);
ifrq.ifr_flags|=IFF_PROMISC;
ioctl(sock,SIOCSIFFLAGS,&ifrq);

若在打開之後,沒有在程式結束前關閉. 它就會一直打開哦 . 所以記得要關閉它.

strncpy(ethreq.ifr_name,"eth0",IFNAMSIZ);
ioctl(sock,SIOCGIFFLAGS,&ifrq);
ifrq.ifr_flags&=~IFF_PROMISC;
ioctl(sock,SIOCSIFFLAGS,&ifrq);

第三. 設filter
filter 的設定主要是使用在實體層和連接層中間 . 用一種近似組語的bpf code 組成.寫起來挺麻煩的 . 所以我們直接使用tcpdump -dd 來產生的binary code 來用 .

for example:
tcpdump -dd ip dst 172.16.0.3
{ 0x28, 0, 0, 0x0000000c },
{ 0x15, 0, 3, 0x00000800 },
{ 0x20, 0, 0, 0x0000001e },
{ 0x15, 0, 1, 0xac100003 },
{ 0x6, 0, 0, 0x00000044 },
{ 0x6, 0, 0, 0x00000000 },
tcpdump -dd ip src 172.16.0.3
{ 0x28, 0, 0, 0x0000000c },
{ 0x15, 0, 3, 0x00000800 },
{ 0x20, 0, 0, 0x0000001a },
{ 0x15, 0, 1, 0xac100003 },
{ 0x6, 0, 0, 0x00000044 },
{ 0x6, 0, 0, 0x00000000 },
tcpdump -dd arp dst 172.16.0.3
{ 0x28, 0, 0, 0x0000000c },
{ 0x15, 0, 3, 0x00000806 },
{ 0x2 0, 0, 0, 0x00000026 },
{ 0x15, 0, 1, 0xac100003 },
{ 0x6, 0, 0, 0x00000044 },
{ 0x6, 0, 0, 0x00000000 },

其實這些code 的產生是有跡可找的..我就把下面程式碼的binary code 原始bpf pesude code 列出來,可以相對應比較看看

/*
udp and host 192.168.9.10 and src port 5000
(000) ldh [12]
(001) jeq #0x800 jt 2 jf 14
(002) ldb [23]
(003) jeq #0x11 jt 4 jf 14
(004) ld [26]
(005) jeq #0xc0a8090a jt 8 jf 6
(006) ld [30]
(007) jeq #0xc0a8090a jt 8 jf 14
(008) ldh [20]
(009) jset #0x1fff jt 14 jf 10
(010) ldxb 4*([14]&0xf)
(011) ldh [x + 14]
(012) jeq #0x1388 jt 13 jf 14
(013) ret #68
(014) ret #0
*/

我們可以依我們的需要去下command 給tcpdump -dd 幫我們產生binary code. tcpdump, 不但區分不同的protocol. 來源,目的地, even 標頭的第幾個byte,和要接收封包的大小, 都可以變化. 實在是太神奇了.

接下來我們要把code 整合到程式裡去 ...

第四 . blocking VS noblocking multiplexing I/O
unblocking 最重要的意思是當有資料流進來時立刻就傳回. 當沒有資料流進來時, 也傳回0.於是我們就可以利用unblocking 和loop 來控制我們要的時間.
以下是程式的寫法:

(fcntl(fd ,F_GETFL) & O_NONBLOCKING) // 1 成功 0 失敗

但是把資料一點一滴的傳進來也並不是我們要的 . 我們還是希望傳進來的資料是一個個block 過的資料,只是當沒有資料進來時, 能夠不要永遠的等在那而己.這就是multiplexing I/O 的概念.當我們read 和recvfrom 一個 file handle 時, 我們可以設定如何沒有資料進來時我要等多久,就能回到程式繼續執行我們要做的動作.
以下是程式的寫法:

#include "sys/time.h"
#include "sys/select.h"

int sock;
struct timeval tv;
fd_set readfds;

sock = socket(...);
tv.tv_sec=1;
tv.tv_usec=0;
FD_ZERO(&readfds); // 清空file handle set.
FD_SET(sock,&readfds); // 加入一個file handle 到file handle set
FD_SET(xxx,&readfds); // 如果還有別的file handle 也要加入同一個
set做控制的話 ..
select(sock+1,&readfds,NULL,NULL,&tv); // 對 file handle set 設
定時間控制
if(FD_ISSET(sock,&readfds)){ // 依readfds的設定來看是否為
true , 依我們的
例出來說,程式會在這裡等上一秒鐘. 如果在這一秒裡有data流進來,
傳回true, 再交給recvfrom把data 接下來, 否則一秒鐘後傳回false
!
// recvfrom(....)
}

基本上把握這幾個主要的重點, 要變化出自己的sniffer 不是問題..剩下來比較討厭的就是把ip 轉成network address to host address..大小印地安,和 inetaddr, inet_addr, inet_aton, inet_ntoa ...這些變來變去的死東西了.

Wireshark 遠端抓取封包功能

在Wireshark較新版本中新增了遠端抓取封包功能，至於遠端抓取封包的好處自然不用說了，可以實現跨地域、彌補缺乏技術支援等等。

本文的主要目的是Demo，如何使用Wireshark進行遠端抓取封包，以及抓取封包中使用到部分技術原理說明。

需要說明的是，WIRESHARK 之所以能夠遠端抓取封包，是因為在安裝WinPcap時，已經Default安裝了一個名為rpcapd的遠端抓取封包程式，位置在\Program Files\WinPcap>。

在本地和遠程機器都安裝完畢WS後，就可以開始遠端抓取封包了。

本例中，2台測試機IP分別是：192.168.10.2（local）和192.168.10.5（remote）。

• 啟動遠端設備rpcapd

在遠端機器中，執行C:\Program Files\WinPcap>rpcapd.exe -n，如下圖

提示service已執行。其中，參數-n的意思是不驗證權限既可連接，更多rpcapd資訊請參照文後所附。

• 連接遠端抓取封包程式

啟動local WIRESHARK，在Capture選項欄選擇Remote，跳出新窗口，要求輸入IP地址、端口及驗證訊息。

由於遠端機器無驗證要求，即匿名可連接，直接輸入IP 192.168.10.3，Port使用2002

 

• 選擇遠端抓取封包網卡

成功連接後，Interface處會顯示遠端IP地址信息。

由於當前機器內通常會有多個網卡，這裡需要選擇正確的capture網卡。

• 抓取封包

以上設置完成後，就可以抓取封包了。

心細的你，可能發現了一些可選設置的地方，即Remote Settings。如果沒有特殊要求或想追求性能的話，建議不要修改其中選擇。

接下來，“Start”即可。

 上圖是遠端抓取封包的測試內容。

另外，從WIRESHARK Title中亦可看出，當前正在遠端抓取封包。

附：rpcapd參數

USAGE:
rpcapd [-b] [-p ] [-6] [-l ] [-a ]
[-n] [-v] [-d] [ -s ] [-f ]
-b
: the address to bind to (either numeric or literal).
Default: it binds to all local IPv4 addresses
-p : the port to bind to. Default: it binds to port 2002
-4: use only IPv4 (default both IPv4 and IPv6 waiting sockets are used)
-l : a file that keeps the list of the hosts which are allowed
to connect to this server ( if more than one, list them one per line).
We suggest to use literal names (instead of numeric ones) in order to
avoid problems with different address families
-n: permit NULL authentication (usually used with '-l')
-a : run in active mode when connecting to 'host' on port 'port'
In case 'port' is omitted, the default port (2003) is used
-v: run in active mode only (default: if ' -a' is specified, it accepts
passive connections as well
-d: run in daemon mode (UNIX only) or as a service (Win32 only)
Warning (Win32): this switch is provided automatically when the service
is started from the control panel
-s : save the current configuration to file
-f : load the current configuration from file; all the switches
specified from the command line are ignored
-h: print this help screen

Enabling VLAN tag capture for Broadcom Ethernet Adapter

There is a registry key under HKLM\SYSTEM\CurrentControlSet\control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00xx that can be set to  cause the driver and chip not to strip the 802.1Q headers. In order to set that key, you need to find the right instance of the driver in Registry Editor and set that key for it. You  can do this by doing following:
1.    Run the Registry Editor (regedit)
2.    Hit CTRL+Home to go to the top of the registry
3.    Hit F3 to bring up a search
4.     Search for  TxCoalescingTicks - actually a search for txcoal will do

This should take you to something like:
HKLM\SYSTEM\CurrentControlSet\control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\00xx

5.    Right-click on a bit of white space near the TxCoalescingTicks field.
6.    Enter "PreserveVlanInfoInRxPacket" –
a.    Then highlight the text PreserveVlanInfoInRxPacket and copy it to the clipboard – you’ll need it again later.
7.    Give the newly created field (PreserveVlanInfoInRxPacket) the value "1".
8.    Hit F3 to repeat the search – goto step 5 again.  Repeat until you reach the beginning again.

9.    Reboot the PC

REF:www.cisco.com/en/US/prod/voicesw/custcosw/ps5693/ps14/prod_system_requirements0900aecd800e3149.pdf
Also: http://wiki.wireshark.org/CaptureSetup/VLAN
--------------------------------------------------------------------------------------------------------------
某台伺服器上要跑一個軟體用pcap抓封包，系統用的是Windows，但是Windows下的驅動過濾了8021q的協議header，導致軟體不能正常工作。 Google了一下， Wireshark的Wiki說要改註冊表
但是經過測試，他給出的方法不能用，至少在現在的驅動上不行​​。 文章中提示的TxCoalescingTicks在註冊表裡面根本找不到!!

在驅動文件bxvbda.sys裡找到了“keep_vlan_tag”的字樣，於是順藤摸瓜發現了這個位置：
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0051 最後這個數字可能不太相同，不過可以搜索“*ReceiveBuffers”試試看。
找到這個鍵值以後就好說了，添加一個REG_SZ 名稱為keep_vlan_tag 值為1的項，重啟。 就可以在Wireshark裡抓到VLAN TAG了。

就是這樣。 驅動版本是5.2.14.0 網卡是Broadcom BCM5708C NetXtreme II

ARP Proxy

        ARP代理就是我們通常說的ARP Proxy，它實際是通過使用一個主機(通常為router)來作為指定的設備對另一設備作出ARP請求的response。

    

    假設有網絡拓撲如上圖所示，PC1/PC2組成的局域網1通過路由器與PC3/PC4組成的局域網2連接在一起。現在PC1要給PC4發一份Packet，具體過程如下(假定Router已開啟ARP Proxy功能)：

        1).PC1首先要判斷PC4是否與自己在同一個網絡。因為PC1的IP掩碼為16位，所有IP地址在128.18.0.1與128.18.255.255之間(包含128.18.0.1和128.18.255.255)的PC都被認為與PC1屬於同一個網絡。

       2).PC4的IP地址為128.18.170.11，在上述IP地址範圍之內，因此PC1認為有可直達PC4的路由，因此，PC1會直接發送ARP Request Packet，請求PC4的MAC地址。ARP Request packet的源IP為PC1的IP，源MAC為PC1的MAC，目的IP為PC4的IP，目的MAC為全0(表示不知道對方MAC)。

       3).ARP Request packet在以太網中被封裝成二層 packet時，幀頭中的源MAC為PC1的MAC地址，目的MAC為全1的廣播地址。

       4).PC4的IP地址為128.18.170.11，IP地址掩碼為24位，所以在PC4看來，IP地址為128.18.178.100的PC1，與它不在同一個網絡，所以網絡中，沒有從PC1到PC4的直達路由。ARP請求 packet從PC1發出後，會由Router接收，Router查看自己的路由表，發現從自己的另外一個端口可以到達PC4，於是代替PC4給PC1回復一個ARP Reply unicast packet。

   雖然Router能請求到PC4的MAC，但是它不會將PC4的MAC直接告訴PC1。而是將自身的MAC提供給PC1，告訴PC1，可以接收它的數據報，在PC1看來，它收到的MAC就是PC4的MAC(其實是PC4的MAC)。

      5).PC1發出數據 packet，源MAC和IP都是自己的MAC和IP，目的IP是PC1的IP地址，目的MAC是Router的MAC。Router收到來自PC1的 packet後，會將目的MAC更換成PC4的MAC，目的IP不變，仍然是PC4的IP地址，源IP也不變，仍然是PC1的IP地址，而源MAC則更換成自己與PC4相連的那個端口MAC地址。然後把重新封裝後的 packet發給PC4，從而完成ARP代理功能。

   備註：Router的高速buffer中會存放與Router的各出接口相連的PC MAC與IP信息，若事先沒有，Router會定期發出ARP廣播 packet請求各個PC的MAC。

      ARP代理的前提條件：

      1).網絡上的主機沒有設置Default Gateway；

      2).網絡上的主機不支持動態路由協議；

---------------------------------------------------------------------------------------------------------

Proxy ARP with Linux

www.internetsolver.com | Other Linux Documents 

---

By David Weis with Internet Solver, LLC

AKA: firewalling a subnet with a single IP address

Why and How

Proxy ARP basically means that a particular machine (such as a firewall) will respond to ARP requests for hosts other than itself. This can be used to make a firewall mostly disappear from the machines on a network.

For an example, say you have a /28 subnet from your ISP that is routed through a Cisco router. Your router appears at the IP of x.x.x.97 with a network address of x.x.x.96 and a broadcast address of x.x.x.111. This leaves a usable chunk of 14 addresses for your hosts.

If you wanted to firewall these hosts from the internet without using proxy arp, you would need to either subnet your addresses and lose two more addresses for the new network and broadcast, plus half of your remaining IP's would be in the non-firewalled half.

Another method would be to have the firewall do port forwarding between all of the addresses to non-routed IP's (192.168.x.x) for your servers. Done properly, this would be okay. It isn't as transparent and may break some protocols like active FTP unless the firewall will compensate.

By using Proxy ARP, you can set up your machines in a DMZ to separate them from your client machines. This is also the least invasive method to set up, since you can keep the same IP's on all of the servers as you had when things weren't firewalled.

To set up the network, you will need a machine with at least two NIC's, three if you want to also masquerade client machines for outgoing access. Some variations on how I configured this are surely possible, but this is how I know how to do it and know that it does work. You will need a 2.4 series kernel, theiproute2 utility, and a recent iptables userspace program.

Doing it

You will need to set up the machine with the software mentioned above. Be sure to compile netfilter into the kernel by selecting yes for "Network Packet Filtering" under the "Networking Options" section. All of the pieces associated with netfilter are listed under "Netfilter Configuration" further down the list. It is probably easier to build each of the options into the kernel than use modules, there should be +- 22 choices to turn on.

Build your kernel, install it, and boot to make sure it functions. You should see some lines like

ip_conntrack (2046 buckets, 16368 max)
ip_tables: (c)2000 Netfilter core team

in the kernel boot messages (use dmesg if they went by too fast).

After you have your kernel running, build and install iproute2 and iptables. Instructions for doing so are in the packages themselves. Your distribution may have included them, but they are probably older ones. Grab the newest ones to make sure you have the right versions. Test them by running ip and iptablesand see if they print something. Don't continue until they do.

After you have the above steps done, you will need to configure your network cards. This step should be done off of the network since you may end up with some conflicting addresses. Give two NIC's identical IP addresses, subnet masks, and gateways. The IP you choose needs to be an unused address on your network. In my case, I used x.x.x.98, since my router is at x.x.x.97. You could actually use about any address on the wire that isn't in use.

There is an example configuration available for download below that uses three NIC's, one for an internal 192.168.x.x network for client machines. If you want to create the file yourself, here are the steps. First off, enable Proxy ARP in the kernel. We'll assume your cards are eth0 and eth1.

echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp

Next, you will tell the kernel how to get to each of the two networks. When you are done, there will be a crossover cable from one NIC on your firewall to your router and the other NIC will be connected to the port on your hub/switch that the router was previously plugged in to. The kernel now thinks that the same machines are on each wire, which definitely won't work. We'll set it straight with these commands:

ip route del x.x.x.96/28 dev eth0
ip route del x.x.x.96/28 dev eth1
ip route add x.x.x.97 dev eth0
ip route add x.x.x.96/28 dev eth1

What we've done is first say that no network is reachable via either NIC, then say that the router (x.x.x.97) is connected to eth0 and the rest of your servers are hooked to eth1. I would suggest using this setup (router on eth0, servers on eth1) since the downloadable example assumes that.

We'll now use the ip command to verify our work. Running ip addr should yield something like this:

1: lo:  mtu 3904 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
2: eth0:  mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:90:27:3f:23:9c brd ff:ff:ff:ff:ff:ff
    inet x.x.x.98/28 brd x.x.x.111 scope global eth0
3: eth1:  mtu 1500 qdisc pfifo_fast qlen 100
    link/ether 00:90:27:3f:4d:6c brd ff:ff:ff:ff:ff:ff
    inet x.x.x.98/28 brd x.x.x.111 scope global eth1

and ip route should show this

x.x.x.98 dev eth0  scope link 
x.x.x.98 dev eth1  scope link 
x.x.x.97 dev eth0  scope link 
x.x.x.96/28 dev eth1  scope link 
127.0.0.0/8 dev lo  scope link 
default via x.x.x.97 dev eth0 

After the routing tables and IP addresses look okay, you can turn on IP forwarding in the kernel by doing this:

echo 1 > /proc/sys/net/ipv4/ip_forward

At this point, you could take your new firewall, hook up the ethernet cables correctly, and have identical functionality (hopefully) to what you have now with no firewalling. Of course, this machine doesn't really do any firewalling, grab the IP tables howto from the link below and set up your tables. You can also use the example script provided below.

Troubleshooting

First, verify that you can ping all of the machines from the firewall, including the router. The main problem you can run into is that the router will probably cache the ARP entries for the machines for quite a while. The easiest way to solve that is to kill the power to your router and plug it back in. Try to ping again.

Let me know if you have any problems, there is a link to my email address at the bottom of the page, along with a place that you can post questions directly on this page.

Downloads

• Example incorporating firewall and proxy arp

Other Sources of Information

• Linux 2.4 Advanced Routing & Traffic Control
• Netfilter Home

Other Stuff

This is a reply to a question on comp.os.linux.networking where I first explained how to do some of this. Above is a cleaned up response. It's here as a source for my copy and paste. :-)

What you want is called proxy-arp. You would set the two NICS to both
have the same real IP address, such as .55 in your second diagram. Then
you do this
echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp

You will need to use the 2.4 kernel and get iproute2, then try these
commands

ip route del x.x.x.32/27 dev eth0
ip route del x.x.x.32/27 dev eth1
ip route add x.x.x.33 dev eth0
ip route add x.x.x.32/27 dev eth1

This tells the kernel that the router is the only thing reachable via
eth0 and the rest of the network is on eth1 (change as needed). This
will make the linux machine respond for the machines on either side.
Finally, do this

echo 1 > /proc/sys/net/ipv4/ip_forward

to enable routing. Either wait a while for the arp caches to expire or
restart your router. At that point you should be able to get back and
forth between the router and the other servers on the network. If you
look at your arp cache on a server, it will show the mac address of the
router as the mac address of eth1 on your linux firewall.

After you have this layer working, you can add your rules.

Good luck!
dave

"Norman D. Megill" wrote:
>
> I want to set up an IP filter in the following setup.  Right now every
> machine is connected directly to the internet with static (real) IP's in
> subnet X.Y.Z.32/27.  X.Y.Z.35-X.Y.Z.54 are DHCP'd with an NT server and
> the others are hard-configured in various machines.  There is currently
> no firewalling.
>
> Current setup:
>                                                          internet
>    other X.Y.Z.32/27 ------------------------------------ISP feed
>      NT/W98 machines      |                            X.Y.Z.32/27
>                           |                            gw=X.Y.Z.33
>                           |
>                           |
>                     NT web server
>                       X.Y.Z.60
>
> The management of the Windows-only office is more paranoid about Linux
> than about security, and furthermore wants no work disruption or risk
> caused by changing IP setups on various machines.  To demo an initial
> firewall, it must be "transparent" so that if it has a problem the
> internal network cable can be instantly unplugged from Linux and hooked
> back to the ISP feed to restore the current configuration.  My idea is
> that once we get it working we can slowly start to tighten things up,
> move the machines to masq'd/forwarded 192.168.x.x's, etc.
>
> Without getting into the security problems that will be initially
> present with this "firewall", if I don't get a "transparent" mode to
> work there is not going to be any firewall at all, or at best it might
> be an NT machine for management comfort.  The current setup has been in
> place for a few years with no apparent security problems, and "if it
> ain't broke don't fix it".
>
> Because both sides of the firewall are on the same subnet, I have not
> been able to get it to work after experimenting with all kinds of
> routing and ip setups.  I am starting to look at bridging, which may be
> the only solution, but the fact that it (I think) sets the NICs to
> promiscuous mode seems against the spirit of the firewall.  But before I
> give up I'll ask about it here.
>
> I am using RedHat 7.0 with kernel 2.2.16 and RH security updates.
>
> Experiment 1:
>                                   eth1       eth0
>    other X.Y.Z.32/27 ----------------- Linux -----------ISP feed
>      NT/W98 machines      |     X.Y.Z.55   X.Y.Z.56    X.Y.Z.32/27
>                           |                            gw=X.Y.Z.33
>                           |
>                           |
>                     NT web server
>                       X.Y.Z.60
>
> Experiment #1 doesn't work because a packet from the internet to
> the X.Y.Z.60 server makes the ISP gateway think that X.Y.Z.60 is
> on its local cable, and it sits there doing "arp who-has" for X.Y.Z.60.
> Of course Linux never responds because it only looks for packets
> to X.Y.Z.56.
>
> Experiment 2:  Same as Experiment 1 but added X.Y.Z.33 to eth1:0 and
> added X.Y.Z.60 to eth0:0
>
> Experiment #2 allows Linux to see the gateway arp's, but it seems to
> think the packets are for itself and I have found no way to
> transparently forward them to the eth1 side.
>
> Now, it seems that what I want should be theoretical possible, but I
> can't figure out how to make Linux can do it (without promiscuous
> bridging).  Adding to my puzzlement is that Figure 3-2 on
>
>    http://www.bb-zone.com/FWHowTo/chapter3.html
>
> shows the exact setup I want.  The author seems to say that the
> FW_ROUTER variable just bypasses the spoofing filter, but that would not
> solve the problem (since for now I have ipchains completely open).  He
> references "the SuSE firewall script," but there is no FW_ROUTER
> variable in SuSE's firewals-2.6-33.rpm if that's the script he means.
>
> Thanks for any advice.