Conntrack helpers - Revision history

Fmyhr: Linked Setting packet connection tracking metainformation page; should probably consolidate.

2021-04-07T20:03:58Z

Linked Setting packet connection tracking metainformation page; should probably consolidate.

← Older revision		Revision as of 20:03, 7 April 2021
Line 76:		Line 76:
	* NFS version 3		* NFS version 3
	* Oracle TNS		* Oracle TNS

			= See also =
			* [[Setting_packet_connection_tracking_metainformation]]

Fmyhr: Grammar, clarification of warning about forwarding packets using conntrack helpers.

2021-04-02T11:49:38Z

Grammar, clarification of warning about forwarding packets using conntrack helpers.

← Older revision		Revision as of 11:49, 2 April 2021
Line 48:		Line 48:
	* You may want to be more restrictive in Rule 3b. For example if you are using ftp passive mode you could use		* You may want to be more restrictive in Rule 3b. For example if you are using ftp passive mode you could use
	<source>ct state related ip daddr $ftphost ct helper "ftp" tcp dport { 1024-65535 } accept</source> and drop other tcp-related traffic.		<source>ct state related ip daddr $ftphost ct helper "ftp" tcp dport { 1024-65535 } accept</source> and drop other tcp-related traffic.
			* If you use a helper to forward traffic to a host behind your stateful router, it is '''critical''' that you use a ''daddr'' expression to restrict such traffic to that specific host in both Rule 2 (helper assignment) and in a rule similar to Rule 3b (related packets) in your [[Netfilter_hooks\|''forward'' ''filter'']] chain(s). Otherwise the helper may allow allow arbitrary port forwarding, much like allowing untrusted remote hosts to inject "dnat"-based port forwarding rules.
	If ~~the~~ helper ~~is needed for~~ a host behind a stateful router ~~its criticial~~ to ~~limit the~~ helper ~~assigment~~ and ~~the "releated" connections~~ to the ~~specific server.~~
	~~This is because helpers~~ may allow arbitrary port forwarding, much like allowing untrusted remote hosts to inject "dnat"-based port forwarding rules.

	You can read more on how to enable conntrack helpers in a secure way [https://github.com/regit/secure-conntrack-helpers/blob/master/secure-conntrack-helpers.rst here].		You can read more on how to enable conntrack helpers in a secure way [https://github.com/regit/secure-conntrack-helpers/blob/master/secure-conntrack-helpers.rst here].

Fw: add explicit warning wrt. helper use on routers

2021-03-12T11:22:55Z

add explicit warning wrt. helper use on routers

← Older revision		Revision as of 11:22, 12 March 2021
Line 47:		Line 47:
	* Rule 2 enables our ''ftp-standard'' ct helper in a ''prerouting'' chain. This makes the ct helper available to both forwarded and input traffic flows. If for some reason you want the ct helper to only be available for forwarded OR input flows, you can put Rule 2 in a ''forward'' or ''input'' chain, respectively.		* Rule 2 enables our ''ftp-standard'' ct helper in a ''prerouting'' chain. This makes the ct helper available to both forwarded and input traffic flows. If for some reason you want the ct helper to only be available for forwarded OR input flows, you can put Rule 2 in a ''forward'' or ''input'' chain, respectively.
	* You may want to be more restrictive in Rule 3b. For example if you are using ftp passive mode you could use		* You may want to be more restrictive in Rule 3b. For example if you are using ftp passive mode you could use
	<source>ct helper "ftp" tcp dport { 1024-65535 } accept</source>		<source>ct state related ip daddr $ftphost ct helper "ftp" tcp dport { 1024-65535 } accept</source> and drop other tcp-related traffic.

			If the helper is needed for a host behind a stateful router its criticial to limit the helper assigment and the "releated" connections to the specific server.
			This is because helpers may allow arbitrary port forwarding, much like allowing untrusted remote hosts to inject "dnat"-based port forwarding rules.

	You can read more on how to enable conntrack helpers in a secure way [https://github.com/regit/secure-conntrack-helpers/blob/master/secure-conntrack-helpers.rst here].		You can read more on how to enable conntrack helpers in a secure way [https://github.com/regit/secure-conntrack-helpers/blob/master/secure-conntrack-helpers.rst here].


	= Supported conntrack helpers =		= Supported conntrack helpers =

Fmyhr: A few edits for clarity.

2021-03-10T16:19:34Z

A few edits for clarity.

← Older revision		Revision as of 16:19, 10 March 2021
Line 3:		Line 3:

	To enable a conntrack helper in your ruleset:		To enable a conntrack helper in your ruleset:
	# Add a ''ct helper <my_ct_helper>'' stateful object which specifies the ~~<kernel_ct_helper_name>~~ to use.		# Add a ''ct helper <my_ct_helper>'' stateful object which specifies the in-kernel name of the ct helper to use.
	# Add a filter rule for the initial protocol negotiation connection, using a ''ct helper set "<my_ct_helper>"'' statement to specify which ct helper to use.		# Add a filter rule for the initial protocol negotiation connection, using a ''ct helper set "<my_ct_helper>"'' statement to specify which ct helper to use.
	# Add filter rules as necessary to allow initial, established and related packets through your firewall.		# Add filter rules as necessary to allow initial, established and related packets through your firewall.
Line 10:		Line 10:
	The following heavily-commented example shows how to enable a helper for [https://en.wikipedia.org/wiki/File_Transfer_Protocol ftp] traffic to the usual tcp/21 port:		The following heavily-commented example shows how to enable a helper for [https://en.wikipedia.org/wiki/File_Transfer_Protocol ftp] traffic to the usual tcp/21 port:
	<source>		<source>
	table inet ~~myhelpers~~ {		table inet stateful_ftp {

	# 1. ct helper stateful object		# 1. ct helper stateful object
	# "ftp-standard" is the name of this ct helper stateful object.		# "ftp-standard" is the name of this ct helper stateful object.
	# "ftp" is the in-kernel name ~~for~~ the ~~ftp~~ ct helper.		# "ftp" is the in-kernel name of the ct helper for ftp.
	ct helper ftp-standard {		ct helper ftp-standard {
	type "ftp" protocol tcp;		type "ftp" protocol tcp;

Fmyhr: New intro; detailed example of using ftp ct helper.

2021-03-10T16:09:39Z

New intro; detailed example of using ftp ct helper.

← Older revision		Revision as of 16:09, 10 March 2021
Line 1:		Line 1:
	~~You can enable conntrack helpers explicitly through your ruleset~~. ~~Use a chain with~~ '~~'prerouting'' hook~~ to ~~make~~ the ~~helpers available~~ to ~~forwarded as well as input traffic. (If you are not forwarding traffic you can use the~~ ''~~input~~'' ~~hook~~.)		Some internet protocols use multiple ports that are negotiated between endpoints during the initial connection. Netfilter's [[Connection_Tracking_System\|connection tracking system]] uses protocol helpers that look inside these negotiation packets to determine which ports will be part of the connection. The ct helper tells conntrack to expect packets to these ports; when such packets arrive conntrack assigns them ''related'' status.

	<~~source lang=~~"~~bash~~">
			To enable a conntrack helper in your ruleset:
			# Add a ''ct helper <my_ct_helper>'' stateful object which specifies the <kernel_ct_helper_name> to use.
			# Add a filter rule for the initial protocol negotiation connection, using a ''ct helper set "<my_ct_helper>"'' statement to specify which ct helper to use.
			# Add filter rules as necessary to allow initial, established and related packets through your firewall.


			The following heavily-commented example shows how to enable a helper for [https://en.wikipedia.org/wiki/File_Transfer_Protocol ftp] traffic to the usual tcp/21 port:
			<source>
	table inet myhelpers {		table inet myhelpers {
	ct helper ftp-standard {
	type "ftp" protocol tcp		# 1. ct helper stateful object
	}		# "ftp-standard" is the name of this ct helper stateful object.
	chain ~~prerouting~~ {		# "ftp" is the in-kernel name for the ftp ct helper.
	type filter hook prerouting priority 0;		ct helper ftp-standard {
	tcp dport 21 ct helper set "ftp-standard"		type "ftp" protocol tcp;
	}		}

			chain PRE {
			type filter hook prerouting priority filter;

			# 2. Rule for initial ftp connection (control channel), specifying ct helper stateful object to use.
			# NOTE "ftp-standard" is the name of the ct helper stateful object.
			tcp dport 21 ct helper set "ftp-standard"
			}

			# Example (partial) input filter base chain.
			# NOTE default policy drop - we have to explicitly accept all allowed packets.
			chain IN {
			type filter hook input priority filter; policy drop;

			# 3a. Rule for ftp control channel.
			# NOTE conntrack works here without needing helper.
			tcp dport 21 ct state new,established accept

			# 3b. Rule for related packets on ftp data channel.
			# NOTE in-kernel ct helper name "ftp" is used here;
			# trying to use ct helper stateful object name "ftp-standard" will NOT work.
			ct helper "ftp" accept
			}
	}		}
	</source>		</source>

	~~The~~ example ~~above shows how~~ to ~~enable~~ the ~~FTP conntrack~~ helper for ~~traffic going through port~~ tcp/~~21 which is the standard FTP control port~~.		Further comments on above example:
			* Rule 2 enables our ''ftp-standard'' ct helper in a ''prerouting'' chain. This makes the ct helper available to both forwarded and input traffic flows. If for some reason you want the ct helper to only be available for forwarded OR input flows, you can put Rule 2 in a ''forward'' or ''input'' chain, respectively.
			* You may want to be more restrictive in Rule 3b. For example if you are using ftp passive mode you could use
			<source>ct helper "ftp" tcp dport { 1024-65535 } accept</source>
			You can read more on how to enable conntrack helpers in a secure way [https://github.com/regit/secure-conntrack-helpers/blob/master/secure-conntrack-helpers.rst here].

	~~You can read more on how to enable conntrack helpers in a secure way [https://github.com/regit/secure-conntrack-helpers/blob/master/secure-conntrack-helpers.rst here].~~

	= Supported conntrack helpers =		= Supported conntrack helpers =

Fmyhr: Clarify placement of 'ct helper set' chain in prerouting vs. input chain.

2021-03-09T17:35:12Z

Clarify placement of 'ct helper set' chain in prerouting vs. input chain.

← Older revision		Revision as of 17:35, 9 March 2021
Line 1:		Line 1:
	You can enable conntrack helpers explicitly through your ruleset. ~~You have~~ to ~~attach your conntrack helper from~~ the ~~prerouting chain~~.		You can enable conntrack helpers explicitly through your ruleset. Use a chain with ''prerouting'' hook to make the helpers available to forwarded as well as input traffic. (If you are not forwarding traffic you can use the ''input'' hook.)

	<source lang="bash">		<source lang="bash">

Pablo: /* Supported conntrack helpers */

2020-12-18T17:51:12Z

Supported conntrack helpers

← Older revision		Revision as of 17:51, 18 December 2020
Line 39:		Line 39:
	* SSDP		* SSDP
	* RPC		* RPC
			* NFS version 3
	* Oracle TNS		* Oracle TNS

Pablo: /* Supported conntrack helpers */

2020-12-18T17:50:50Z

Supported conntrack helpers

← Older revision		Revision as of 17:50, 18 December 2020
Line 32:		Line 32:
	* Amanda		* Amanda

	The [https://~~www~~.netfilter.org/~~projects/conntrack-tools/~~ conntrackd] daemon also provides support for userspace helpers, such as:		The [https://conntrack-tools.netfilter.org/manual.html#helpers conntrackd] daemon also provides support for userspace helpers, such as:

	* DHCPv6		* DHCPv6

Pablo: /* Supported helpers */

2020-12-18T17:50:14Z

Supported helpers

← Older revision		Revision as of 17:50, 18 December 2020
Line 17:		Line 17:
	You can read more on how to enable conntrack helpers in a secure way [https://github.com/regit/secure-conntrack-helpers/blob/master/secure-conntrack-helpers.rst here].		You can read more on how to enable conntrack helpers in a secure way [https://github.com/regit/secure-conntrack-helpers/blob/master/secure-conntrack-helpers.rst here].

	= Supported helpers =		= Supported conntrack helpers =

	Conntrack provides the following helpers:		Conntrack provides the following helpers:

Pablo at 17:50, 18 December 2020

2020-12-18T17:50:04Z

@@ Line 13: / Line 13: @@
 </source>
-The example above shows how to enable the FTP conntrack helper for traffic going through port tcp/21.
+The example above shows how to enable the FTP conntrack helper for traffic going through port tcp/21 which is the standard FTP control port.
 You can read more on how to enable conntrack helpers in a secure way [https://github.com/regit/secure-conntrack-helpers/blob/master/secure-conntrack-helpers.rst here].