23 Jun
2016
23 Jun
'16
2:15 p.m.
On Thursday 23 June 2016 16:08:07 Amuza wrote:
Hey Ilario!
1. Thanks for your reply! It made me understand that I might need to
configure a transparent (Layer 2) firewall if I keep wanting to solve it
just by configuring my private home router. I am not sure though. If
anyone could confirm... And I do not know how to configure that, I guess
I would have to face once and for all the scary world of iptables -if
that's how OpenWRT filters packets, I'm not even sure : /
2. Another solution -easier- I've just thought of, it would be to
configure the firewall in the LiMe router (the one directly connected to
my home router). But then I would need to know what is applied first
when traffic originated from a host in the LiMe network has the Internet
as destination: NAT or Packet Filtering. I need to know if NAT is
applied before packet filtering or the other way around so that I can
properly define the firewall rules. Does anybody know the order?
3. By the way, Am I too paranoid? Am I the only one worried about
protecting my home LAN? Or maybe you guys do not use this double NAT
architecture? How do you do it? Maybe through VLANs?
I just try that everything can ping everything, "mesh all the things".
Security doesn't pertain to lower layer of networking stack, moreover you are
supposed to run a community network, not a walled garden :p
Ciao!
On jue, 2016-06-23 at 00:38 +0200, Ilario Gelmetti wrote:
> On 06/21/2016 08:59 PM, Amuza wrote:
> > Hi,
>
> Hi Amuza!
>
> > I have my private home network connected to the Internet and then the
> > LiMe network I am deploying. In order to let the LiMe network access
> > the Internet, I connect the WAN port of a LiMe router to a switch port
> > (LAN) of my private home router. And it just rocks, double NAT works,
> > and routers spread the Internet all around the mesh.
>
> Yeah!
>
> > But now I am trying to deny any traffic from LiMe hosts (10.x.x.x) to
> > my private home network (192.168.x.x).
>
> Have you verified that this doesn't already happen?
> For example trying to ping a 192... machine while connected with a 10...
> IP?>
> > I have been playing with the LuCI web interface of my private home
> > router but somehow I do not manage to restrict the undesired traffic.
> > This is what I've tried:
> >
> > 1. I assign a static IPv4 address to the LiMe router (I did not manage
> > do it with IPv6).
>
> Mmh... So, are you setting this directly in LiMe or in your main router
> DHCP server?
> I have no experience with the LiMe web interface, but from the terminal
> interface you can specify the IPv6 address (as well the IPv4) in the
> /etc/config/lime (taking inspiration from /etc/config/lime.example).
>
> > 2. I create a traffic rule which DROPS ANY traffic coming from the
> > statically assigned IPv4 address (192.168.A.A) of the connected LiMe
> > router (which is in the LAN zone and with a defined source MAC
> > address) with destination ANY LAN zone -so that they can access only
> > the Internet (WAN).
> >
> > 3. I enable the rule and put it up to the top of the list
> >
> > Why can I still reach my home private router from the LiMe network?
>
> "reach the router"?
> If I got it correctly the router is your gateway, so it's good if you
> can reach it... The problem comes with other devices on the LAN side.
> Did I get it correctly?
>
> > Is this "zone" thing working?
> > How should I configure it?
>
> I'm not experienced with OpenWrt firewall configuration, sorry :/
>
> > Please let me know. Either through the LuCI web interface or the
> > command line -step by step, please.
> >
> > Thank you!
>
> Bye!!
> Ilario
>
> _______________________________________________
> users mailing list
> users(a)lists.libre-mesh.org
> https://lists.libre-mesh.org/mailman/listinfo/users