0

I have two computers, each one with two network interfaces, both are ubuntu. I want to implement bellow architecture:

enter image description here

I need to generate traffic from interface eth0:192.168.1.1 to interface 192.168.2.1 through firewall machine. How to implement this architecture?

by considering usage of iptables linux packet filtering in firewall machine to filter traffic.

another consideration: use of this architecture as a replicator of pcap files (client traffic on one interface and server traffic on another interface through firewall machine )

  • This is an interesting case. May I ask why you would want to route the traffic through the firewall instead to the host's own interface? – StockB Apr 29 '16 at 18:23
  • 1
    special case : to replay pcap file packets, client traffic on one interface and server traffic on other interface ... – kikilinux Apr 30 '16 at 5:56
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 7 '17 at 20:22
1

In this configuration the client machine will have directly connected route in its routing table, for both networks. Those route are of kernel type and will always be preferred over other routes you could set.

So whatever your configuration is, the traffic initiated on this machine destined to 192.168.2.1 will always be considered as local and will never exit trough eth0.

I doubt you could change Ubuntu routing decision on a kernel type route, but who knows?

You may use a software that will generate the traffic sending it trough eth0 irrespectively of the machine routing table

Even if you do so, the answer will not pass trough the firewall, since the answer will be directd to 192.168.1.1 which, once again is a local address.

or

You can setup on the client machine a virtual machine, and configure the 192.168.2.1 IP address in this VM, then set on the client machine a route to send traffic destined to 192.168.2.1 via 192.168.1.2

Regarding the pcap replicator I don't get it...

| improve this answer | |
  • I can use the command: ping -I eth0 192.168.2.1 to send ping traffic via eth0 but it just send the packets on this interface and nothing pass through firewall machine, I can just seen the packet received by firewall machine and not send to interface 192.168.2.1 even to interface 192.168.2.2 ... – kikilinux Apr 29 '16 at 12:01
  • The "-I eth0" option actually force the ping to leave trough eth0. Is routing on your firewall machine configured correctly ? – JFL Apr 29 '16 at 12:07
  • When the firewall interface directly connected to each network, is it needed to define route ?!!! – kikilinux Apr 30 '16 at 5:57
  • No, but is IP routing enabled? – JFL Apr 30 '16 at 7:54
  • If you mean /proc/sys/net/ipv4/ip_forward, yes it is enable. – kikilinux Apr 30 '16 at 8:02
1

One possible soloution is network namespaces (basically the linux equivilent of what router vendors call VRFs).

Each network namespace is logically a seperate instance of the network stack. so if you put the two network interfaces in seperate network namespaces then they will only be able to communicate via the firewall.

If you want to be able to monitor/inject in the main network namespaces then you can leave the physical interfaces in the main network namespace and connect them to secondary network namespaces through bridges and veth devices.

| improve this answer | |
0

You can use tcpreplay to send out a previously captured trace on a specific interface.

| improve this answer | |
  • Can tcpreplay send out client-server packets separately to different interface? I don't think so. – kikilinux May 1 '16 at 4:20
  • It should. – StephenKing May 1 '16 at 7:53
0

I think you can NAT the 192.168.2.1 to a different address on the firewall device and send traffic to that IP address.

eg NAT 192.168.2.1 to 10.1.1.1.

Send traffic to 10.1.1.1 so that the firewall would unnat the IP to the 192.168.1.1 and send it to the client on the other interface.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.