This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Drop External RFC-1918

For some reason, I'm able to route to and ping IPs in the 10.x.x.x/8 network out on my ISP's network from within my NATted LAN. This causes problems for me inside of my network, as the Windows hosts complain about "IP already in use" when trying to assign them certain RFC-1918 IPs.

How do I configure my ASG to drop traffic bound to RFC-1918 addresses *outside* of my internal network? Bear in mind, I use 192.168.x.x, and 10.x.x.x on my internal network, and don't want to break things like VPNs (which use 10.242.[1-4].x, iirc).

I'm running 7.104.

Thanks!

This thread was automatically locked due to age.

0 Gert Hansen over 17 years ago

i slashdevnull,

you should be able to do this by using the 'interface' attribute of the network definition object. just create a network definition:
name: 'ISP 10/8 network'
baseip: 10.0.0.0
netmask: /8
interface: External Interface

than reject all traffic from Internal Network -> ISO 10/8 network.

That's it, the ipsec traffic is not affected as it is routed through the virtual ipsec0 interface, which does not match the external interface.

i hope that helps,

regards
Gert
Cancel
Vote Up 0 Vote Down

Cancel
0 slashdevnull over 17 years ago in reply to Gert Hansen

I believe that's what I tried earlier, but I'll give it another go and see what happens.
Cancel
Vote Up 0 Vote Down

Cancel
0 slashdevnull over 17 years ago in reply to slashdevnull

Tested. Not working.

I created a network definition as you indicated, then a packet filter rule. Applied the rule, and tested with ping and traceroute. No joy.
Cancel
Vote Up 0 Vote Down

Cancel
0 slashdevnull over 17 years ago in reply to slashdevnull

Any other suggestions? Anyone?
Cancel
Vote Up 0 Vote Down

Cancel
0 ClausP over 17 years ago in reply to slashdevnull

Any active DNAT rules (external interface) ?
Cancel
Vote Up 0 Vote Down

Cancel
0 slashdevnull over 17 years ago in reply to ClausP

Yes, I do have some DNAT rules specified. I'm using DNAT to map external-to-internal traffic for HTTP and SMTP to 2 different internal hosts.
Cancel
Vote Up 0 Vote Down

Cancel
0 slashdevnull over 17 years ago in reply to slashdevnull

I was able to resolve this by just defining some interfaces on my ASG with the appropriate RFC-1918 addresses assigned to them. Basically, defining a route to the "offending" networks, that goes to nowhere, rather than being handed off to the default gateway.
Cancel
Vote Up 0 Vote Down

Cancel