amal/ungleich-staticcms
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

++doc update

Browse source
This commit is contained in:
Nico Schottelius 2020-08-27 11:31:29 +02:00
parent 7bab16f434
commit 16f6a2cddf
1 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
content/u/blog/nftables-block-dhcp-and-router-advertisements/contents.lr
View file

@ -26,7 +26,8 @@ customer abusing another customer.
## The problem ## The problem
The virtual machines in our next generation uncloud hosting will be The virtual machines in our next generation uncloud hosting will be
using standard DHCP and IPv6 address assignments and not the using standard DHCP and IPv6 address assignments. Currently
we are still using the
[OpenNebula](https://github.com/OpenNebula/addon-context-linux) [OpenNebula](https://github.com/OpenNebula/addon-context-linux)
contextualisation scripts that read the networking information from an contextualisation scripts that read the networking information from an
attached ISO. attached ISO.
@ -44,6 +45,8 @@ retrieve more information from a metadata server. So the main
protection that is required is preventing to trick other customers protection that is required is preventing to trick other customers
into using a wrong IP address or route. into using a wrong IP address or route.
Also, if the network is IPv6 only, another customer should not be able
to trick someone else into using IPv4.
## Fixing it ## Fixing it
@ -56,8 +59,6 @@ table bridge filter {
chain prerouting { chain prerouting {
type filter hook prerouting priority 0; type filter hook prerouting priority 0;
policy accept; policy accept;
} }
``` ```
@ -65,14 +66,15 @@ Next we create a chain to drop the packets we dislike:
``` ```
chain drop_ra_dhcp { chain drop_ra_dhcp {
# Default blocks: router advertisements, dhcpv6, dhcpv4 # Blocks: router advertisements, dhcpv6, dhcpv4
icmpv6 type nd-router-advert drop icmpv6 type nd-router-advert drop
ip6 version 6 udp sport 547 drop ip6 version 6 udp sport 547 drop
ip version 4 udp sport 67 drop ip version 4 udp sport 67 drop
} }
``` ```
Now the only thing left is to correctly classify the traffic: Now the only thing left is to correctly classify the traffic. For this
lets take some real world assumptions:
* Let's assume the bridge is named **br100** * Let's assume the bridge is named **br100**
* Let's assume the upstream interface that should allow RA/DHCP is * Let's assume the upstream interface that should allow RA/DHCP is