{{tag>linux router mtu netfilter }} =====Basic Netfilter Function Block Diagram===== Both NFTables and IPTables use the [[https://en.wikipedia.org/wiki/Netfilter|Netfilter]] framework provided in the Linux kernal. NFtables was implemented to supersede IPTables, which due to the widespread use of IPTables, will probably take a long time.\\ {{:linux_router:linux_netfilter.png?600|}} The following is a basic block diagram of the Netfilter Filter and NAT (Network Address Translation) functions, which are the basic requirements for router. Incoming Packets | ┌────────────┐ │ Prerouting │ │ Rules │ └────────────┘ | /----------\ | Routing | NAT | Decision |-----------------| | Rules | Filter | \----------/ | | | |------------| | | Input | | | Rules | | |------------| | | | |-------------------| |----------| | Network Processes | | Forward | | within Router | | Rules | |-------------------| |----------| | | |------------| | | Output | | | Rules | | |------------| | | FILTER | | |------------------| | | NAT |-------------| | Postrouting | | Rules | |-------------| | Outgoing Packets Some references: *Netfilter.org iptables how to [[https://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html|Saying how to mangle the packets]] *[[https://linux.die.net/man/8/iptables|iptables(8) - Linux man page]] *[[http://www.oocities.org/youssef116/writing/ratelim.html|The iptables Rate-Limiting Module]] *Nixcraft [[https://www.cyberciti.biz/tips/linux-iptables-9-allow-icmp-ping.html|IPTables allow or block ICMP ping request]] *[[http://www.microhowto.info/howto/limit_the_rate_of_inbound_tcp_connections_using_iptables.html|Limit the rate of inbound TCP connections using iptables]] *[[https://thelowedown.wordpress.com/2008/07/03/iptables-how-to-use-the-limits-module/|iptables: How to use the limits module]] *[[https://debian-administration.org/article/187/Using_iptables_to_rate-limit_incoming_connections|Using iptables to rate-limit incoming connections]] *The Geek Stuff: *[[https://www.thegeekstuff.com/2011/01/iptables-fundamentals/|Linux Firewall Tutorial: IPTables Tables, Chains, Rules Fundamentals]] *[[https://www.thegeekstuff.com/2011/06/iptables-rules-examples/#comments|25 Most Frequently Used Linux IPTables Rules Examples]] *[[https://www.thegeekstuff.com/2010/07/fail2ban-howto/|Fail2Ban Howto: Block IP Address Using Fail2ban and IPTables]] *[[https://www.thegeekstuff.com/scripts/iptables-rules|iptables script]] *[[http://www.epicvoyage.org/blog/geek-stuffiptables-spammers-are-annoying-right|Geek Stuff/iptables: Spammers are Annoying, Right?]] *Cisco [[http://www.ciscopress.com/articles/article.asp?p=174313&seqnum=4|General Design Considerations for Secure Networks]] *Oregon Tech [[http://oregontechsupport.com/articles/icmp.txt|icmp.txt]] ====PPPoE MTU Requirements==== The PPPoE connection have various additional overhead to that in a standard Ethernet data field. The maximum length (MTU) of the data field of a standard Ethernet data field is limited 1500 bytes. A standard PPPoE connection has an additional overhead of 8 bytes, which limits the MTU to 1492 bytes. However, some ISP (internet service providers) may have additional overheads. To determine the the largest MTU use the ping command. The ping command has a 28 bytes overhead (20 bytes IP header + 8 bytes for ICMP header). So the MTU is the greatest value that can be pinged without a fragmentation error, plus 28 bytes for the ping overhead. For a normal PPPoE connection this would be 1492 - 28 = 1464 bytes. (Note that a problem with this method is that it probably uses an existing modem router that sets the MTU, and it is possible that this setting acts as the limiter.) Some command examples: *''ping -s 1464 -c1 google.com'' *''tracepath vorash.stgraber.org'' See references: [[https://ubuntuforums.org/showthread.php?t=872346|How to Optimize your Internet Connection using MTU and RWIN]], [[https://samuel.kadolph.com/2015/02/mtu-and-tcp-mss-when-using-pppoe-2/|MTU and TCP MSS when using PPPoE]], [[https://www.lifewire.com/tcp-headers-and-udp-headers-explained-817970|TCP Headers and UDP Headers Explained]], [[http://www.znep.com/~marcs/mtu/|Path MTU Discovery and Filtering ICMP]] **Cisco** [[https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html|Resolve IP Fragmentation]], [[https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html|MTU]], [[https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html|MSS]], and [[https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html|PMTUD Issues with GRE and IPSEC]], [[https://supportforums.cisco.com/t5/wan-routing-and-switching/understanding-mtu-for-adsl/td-p/2363074|Understanding MTU for ADSL]], and **Wikipedia** [[https://en.wikipedia.org/wiki/IPv4#IHL|IPv4]], [[https://en.wikipedia.org/wiki/EtherType|Ethertype]], [[https://en.wikipedia.org/wiki/IEEE_802.1Q|IEEE 802.1Q]], [[https://en.wikipedia.org/wiki/Maximum_transmission_unit|Maximum transmission unit]], [[https://en.wikipedia.org/wiki/Point-to-point_protocol_over_Ethernet|Point-to-point protocol over Ethernet]], [[https://en.wikipedia.org/wiki/IPv6_packet|IPv6 packet]], [[https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol_version_6|Internet Control Message Protocol version 6]], and [[https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol_version_6|Path MTU Discovery]]. The MSS is normally just 40 bytes less than the MTU. The MSS is used to avoid IP fragmentation at endpoints of TCP connections. The MSS is just the TCP data size and excludes the IP and TCP headers that are normally 20 bytes each. So normal mss would be 1492 - 40 = 1452 bytes Some Ethernet data field overheads to consider: *PPPoE header = 8 bytes *IP header = 20 bytes, but can grow up to 60 bytes with options that are rarely used. *ICMP header = 8 bytes *TCP header = 20 bytes, but like IP can grow to 60 bytes long The Ethernet datafield (MTU) is limited to 1500 bytes and the maximum Ethernet frame size must be 1536 bytes or greater. The following overheads in the Ethernet frame, over the MTU are given for information: *Preamble = 8 bytes *Destination MAC = 6 bytes *Source MAC = 6 bytes *VLAN header (optional) = 4 btyes *EtherType/Size = 2 bytes *Payload = maximum 1500 bytes (MTU) *CRC/FCS = 4 bytes *As can be seen above the Ethernet frame overhead is normally a minimum of 26 bytes and 30 bytes with VLAN (IEEE 802.1Q) tagging. To set the PPPoE connection mtu edit the following file ''sudo vim /etc/ppp/ip-up'' and append the following to the end of the file: ''/sbin/ifconfig ppp0 mtu 1492''. ====ICMP Filtering==== There seems to be a lot of conflicting information on filtering ICMP, too much!. ICMP is a fundamental component of IP protocal suite and simply blocking it in entirety is poor practice. In fact IPv6 will not function correctly without ICMP. Some judicious filtering and rate limiting seems the correct solution. The following is some reading on ICMP: *[[http://oregontechsupport.com/articles/icmp.txt|Advanced ICMP Filtering with iptables]] *[[https://serverfault.com/questions/84963/why-not-block-icmp|Why not block ICMP?]] *[[https://security.stackexchange.com/questions/22711/is-it-a-bad-idea-for-a-firewall-to-block-icmp/22713#22713|Is it a bad idea for a firewall to block ICMP?]] *[[https://datatracker.ietf.org/doc/draft-ietf-opsec-icmp-filtering/|Recommendations for filtering ICMP messages]] *[[https://ubuntuforums.org/showthread.php?t=2353951|Thread: iptables ICMP types]] *[[http://www.networksorcery.com/enp/protocol/icmp/msg3.htm|ICMP type 3, Destination unreachable message]] *[[https://community.ubnt.com/t5/EdgeMAX/Recommendations-for-filtering-ICMP-messages/td-p/560143|Recommendations for filtering ICMP messages]] *[[https://arstechnica.com/civis/viewtopic.php?t=1199159|ICMP and Traceroute best practices]] *[[https://tools.ietf.org/html/draft-ietf-opsec-icmp-filtering-04|Recommendations for filtering ICMP messages]] <- linux_router:ipoe|Prev page ^ linux_router:start|Start page ^ linux_router:nftables|Next page ->