[9.000][ANSWERED] Spoof protection

Hi,
sometime ago there was a post in the production forum on how to connect to an ADSL modem using a second address on the external interface. I couldn't get that setup to work, so I chose to use vlans.

the vlan setup worked except for the 20000 packets a day from the modem that were rejected.
Eventually I dropped the vlan setup and only used the second address on the external interface, This works as long as spoof protection is turned off.

I tried again with spoof protection turned on at normal level and was not able to connect to the modems. Turn spoof protection off and bingo modem connectivity returns.

Ian[[:)]][:S][[:)]]

0 BarryG over 12 years ago

Is the IP of the modem in the same network range as your LAN?
If so, can you change it?

Barry
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to BarryG

Neither modem is in the same range or in my internal network ranges.

10.199.199.x and 10.99.99.x for the modems.

internals are 192.168.x.x based

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 12 years ago

What are the rules/Nat created so far?( just to compare with the ones we have as my connection to modem works with spoof protection on)

Sent from my iPhone using Astaro.org
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to wingman

Hi Wingman,
I don't have any specific packet filter rules.

I have attached screen shots of the interface and masq configuration.

Ian
- nat-1.JPG
- View
- Hide
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 12 years ago

Hi Ian

I don't have a masq configuration.I have a DNAT only so that if traffic coming from my network goes to then it get translated to the modem address

in your case internal traffic going to 10.99.99.1/24 will be translated to the actual model address (which is on the same subnet)

let me know how it goes
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to wingman

Hi Wingman,
sorry I don't understand your post.

I have an extra address on one ADSL service 10.99.99.1/24 (modem1) on the second ADSL service I have an extra address 10.199.199.1/24 (modem2).

My internal address is 192.168.x.x/24

I have a masq from internal to modem1 extra address interface.
I have another masq internal to modem2 extra address interface.

I can access the modems with spoof protection turned off.

A bit of history.
The spoof problem started before I put the extra addresses on the external interfaces, when I had the modems using the VLAN setup. Rather than spoof I would have though the packets should have been dropped.

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 wingman over 12 years ago

I only have the additional address and DNAT rule (not a masq) configured

It never worked for me with just a masq and not DNAT. Can you try creating a DNAT with the following settings
source: 192.168.x.x/24
Service: Any
Destination: 10.99.99.1/24 (this should be the "additional" ip created on the interface connected to the modem)

Translated Destination: Real ip of the modem

Disable the MASQ and enable log the initial packets on the DNAT rule to view them on FW log
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 12 years ago in reply to wingman

Hi Wingman,
perhaps I didn't make it clear that the modems are in bridge mode.

Experimentation. Found that the NAT was a waste of time, the traffic is being handled by the http proxy. Put the IP ranges in the proxy bypass and no connections with or without MASQ/DNAT.
Using the DNAT the initial packets appear in the log, but no connection.

So final setting that works is http proxy and spoof disabled.

Thank your for your help.

Ian
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[9.000][ANSWERED] Spoof protection

Submitted a Tech Support Case lately from the Support Portal?