iptables - how does one negate multiple prerouting sources?

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
davidmoore
DD-WRT Novice


Joined: 05 Mar 2018
Posts: 8
Location: Internet

PostPosted: Tue Oct 19, 2021 21:31    Post subject: iptables - how does one negate multiple prerouting sources? Reply with quote
I know this question has been asked historically, but the answers I have yet to find are not all too helpful in this one niche use case.

I currently have one router running DD-WRT on 192.168.0.1, one router connected to the previous with IP 192.168.0.2 that runs as a VPN client, and one Raspberry Pi set up to run pi-hole DNS filtering on 192.168.0.21.

Ultimately, my goal here is just to block all DNS requests on my network from any device to any DNS server except for my second router and my pihole, and to allow only those two devices to make DNS requests.

---------
On my router, my current Firewall(iptables) rules are as follows:

Code:

#####Keep network on pi-hole
iptables --table nat --insert PREROUTING --in-interface br0 --protocol tcp --source ! 192.168.0.2,192.168.0.21 --destination-port 53 --jump DNAT --to-destination 192.168.0.21:53
iptables --table nat --insert PREROUTING --in-interface br0 --protocol udp --source ! 192.168.0.2,192.168.0.21 --destination-port 53 --jump DNAT --to-destination 192.168.0.21:53
#####Punch DNS hole for pi-hole
iptables --table nat --insert PREROUTING --in-interface br0 --protocol tcp --source 192.168.0.2,192.168.0.21 --destination-port 53 --jump ACCEPT
iptables --table nat --insert PREROUTING --in-interface br0 --protocol udp --source 192.168.0.2,192.168.0.21 --destination-port 53 --jump ACCEPT

----------
Now, I had just assumed this was all working fine and dandy. However, I never actually went in and *tried* to test the rules. Upon trying to execute the commands, I find that rules 3 and 4 work fine. However, rules 1 and 2 do not:
Code:

root@ddwrt:~# iptables --table nat --insert PREROUTING --in-interface br0 --protocol tcp  --source ! 192.168.0.2,192.168.0.21 --destination-port 53 --jump ACCEPT
Bad argument `192.168.0.2,192.168.0.21'

--------------
Some research led to me thinking maybe I had been a fool when I originally copypaste-adapted some rules and that the `!` should obviously go before the `--source`, so I tried that, which might have worked, except multiple source IP addresses are disallowed by my version of iptables:
Code:

root@ddwrt:~# iptables --table nat --insert PREROUTING --in-interface br0 --protocol tcp ! --source 192.168.0.2,192.168.0.21 --destination-port 53 --jump ACCEPT
iptables v1.8.5 (legacy): ! not allowed with multiple source or destination IP addresses


More research led me to attempt using ipset to solve the problem:
Code:

root@ddwrt:~# ipset -N piholeAndVpnPassthrough iphash
root@ddwrt:~# ipset -A piholeAndVpnPassthrough 192.168.0.2
root@ddwrt:~# ipset -A piholeAndVpnPassthrough 192.168.0.21

That part went fine. However, having never used ipset, I couldn't get it to work in any manner I tried:
Code:

root@ddwrt:~# iptables --table nat --insert PREROUTING --in-interface br0 --protocol tcp ! --source --match-set "piholeAndVpnPasshthrough" --destination-port 53 --jump DNAT --to-destination 192.168.0.21:53
Bad argument `piholeAndVpnPasshthrough'
Try `iptables -h' or 'iptables --help' for more information.
root@ddwrt:~# iptables --table nat --insert PREROUTING --in-interface br0 --protocol tcp ! --source -m set --match-set piholeAndVpnPasshthrough --destination-port 53 --jump DNAT --to-destination 192.168.0.21:53
Bad argument `set'
Try `iptables -h' or 'iptables --help' for more information.
root@ddwrt:~# iptables --table nat --insert PREROUTING --in-interface br0 --protocol tcp -m set --match-set piholeAndVpnPasshthrough ! --source --destination-port 53 --jump DNAT --to-destination 192.168.0.21:53
iptables v1.8.5 (legacy): --match-set requires two args.
Try `iptables -h' or 'iptables --help' for more information.
root@ddwrt:~# iptables --table nat --insert PREROUTING --in-interface br0 --protocol tcp -m set --match-set piholeAndVpnPasshthrough src ! --source --destination-port 53 --jump DNAT --to-destination 192.168.0.21:53
iptables v1.8.5 (legacy): Set piholeAndVpnPasshthrough doesn't exist.

------------
Thus, I have no idea how to accomplish this. How does one use two negated source addresses in iptables?

_________________
Linksys WRT1900ACSv2 (v3.0-r47510) | Netgear WNDR3700v4 (DD-WRT v3.0-r34777) | Linksys WRT54Gv1 (DD-WRT v24 SP1)
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 8597
Location: Netherlands

PostPosted: Wed Oct 20, 2021 6:34    Post subject: Reply with quote
I have moved your question to the Advanced Networking forum where it can grab more attention for this subject Smile

About negation, that has changed recently, all such negations must now precede the option itself, NOT the argument. so not -s ! 192.168.1.1 but ! -s 192.168.1.1

About Ipset see the sticky in this forum:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
(it actually covers blocking all rogue DSN queries)

About Pihole DNS see:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=329571
Also a sticky in the Advanced Networking forum

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
davidmoore
DD-WRT Novice


Joined: 05 Mar 2018
Posts: 8
Location: Internet

PostPosted: Wed Oct 27, 2021 9:24    Post subject: Reply with quote
[quote="egc"]I have moved your question to the Advanced Networking forum where it can grab more attention for this subject Smile

About negation, that has changed recently, all such negations must now precede the option itself, NOT the argument. so not -s ! 192.168.1.1 but ! -s 192.168.1.1

About Ipset see the sticky in this forum:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
(it actually covers blocking all rogue DSN queries)


Thanks mate!

_________________
Linksys WRT1900ACSv2 (v3.0-r47510) | Netgear WNDR3700v4 (DD-WRT v3.0-r34777) | Linksys WRT54Gv1 (DD-WRT v24 SP1)
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum