From 9719bd0349d74306b44c827ed117ed09d493f840 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 13 Oct 2008 16:13:29 +0200 Subject: manual: add initial user manual This patch adds the manual in docbook format to the conntrack-tools. Signed-off-by: Pablo Neira Ayuso --- doc/manual/Makefile | 4 + doc/manual/config.xsl | 10 + doc/manual/conntrack-tools.tmpl | 577 ++++++++++++++++++++++++++++++++++++++++ doc/manual/docbook.css | 43 +++ 4 files changed, 634 insertions(+) create mode 100644 doc/manual/Makefile create mode 100644 doc/manual/config.xsl create mode 100644 doc/manual/conntrack-tools.tmpl create mode 100644 doc/manual/docbook.css (limited to 'doc/manual') diff --git a/doc/manual/Makefile b/doc/manual/Makefile new file mode 100644 index 0000000..bd179a6 --- /dev/null +++ b/doc/manual/Makefile @@ -0,0 +1,4 @@ +html-no-chunks: + xmlto xhtml-nochunks -m config.xsl conntrack-tools.tmpl +clean: + rm -f conntrack-tools.html diff --git a/doc/manual/config.xsl b/doc/manual/config.xsl new file mode 100644 index 0000000..04722a5 --- /dev/null +++ b/doc/manual/config.xsl @@ -0,0 +1,10 @@ + + + + + + + + diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl new file mode 100644 index 0000000..e27eb46 --- /dev/null +++ b/doc/manual/conntrack-tools.tmpl @@ -0,0 +1,577 @@ + + + + + + The conntrack-tools user manual + + + + Pablo + Neira Ayuso + +
+ pablo@netfilter.org +
+ + + + + + 2008 + Pablo Neira Ayuso + + + + + Permission is granted to copy, distribute and/or modify this document + under the terms of the GNU Free Documentation License, Version 1.2 + or any later version published by the Free Software Foundation; + with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. + A copy of the license is included in the section entitled "GNU + Free Documentation License". + + + + + This document details how to install and configure the + conntrack-tools + 0.9.8. This software is under development, for that reason, it is likely + that this document will evolve in the future to cover new features and + changes. + + + + + + Introduction + + This document should be a kick-off point to install and configure the + conntrack-tools. + If you find any error or imprecision in this document, please send an email + to the author, it will be appreciated. + + In this document, the author assumes that the reader is familiar with firewalling concepts and iptables in general. If this is not your case, I suggest you to read the iptables documentation before going ahead. Moreover, the reader must also understand the difference between stateful and stateless firewalls. If this is not your case, I strongly suggest you to read the article Netfilter's Connection Tracking System published in :login; the USENIX magazine. That document contains a general description that should help to clarify the concepts. + +If you do not fulfill the previous requirements, this documentation is likely to be a source of frustration. Probably, you wonder why I'm insisting on these prerequisites too much, the fact is that if your iptables rule-set is stateless, it is very likely that the conntrack-tools will not be of any help for you. You have been warned! + + + What are the conntrack-tools? + + The conntrack-tools are a set of free software tools for GNU/Linux that allow system administrators interact, from user-space, with the in-kernel Connection Tracking System, which is the module that enables stateful packet inspection for iptables. Probably, you did not hear about this module so far. However, if any of the rules of your rule-set use the state or ctstate iptables matches, you are indeed using it. + + + +The conntrack-tools package contains two programs: + + + + conntrack is command line interface conntrack provides a more flexible interface to the connnection tracking system than /proc/net/ip_conntrack. With conntrack, you can show, delete and update the existing state entries; and you can also listen to flow events. + + + conntrackd is the user-space connection tracking daemon. This daemon can be used to deploy fault-tolerant GNU/Linux firewalls but you can also use it to collect flow-based statistics of the firewall use. + + + + Although the name of both tools is very similar - and you can blame me for that, I'm not a marketing guy - they are used for very different tasks. + + + + Requirements + + You have to install the following software in order to get the conntrack-tools working. Make sure that you have installed them correctly before going ahead: + + + + Linux kernel version >= 2.6.18 that, at least, has support for: + + + Connection Tracking System. + + + CONFIG_NF_CONNTRACK=m + + + CONFIG_NF_CONNTRACK_IPV4=m + + + CONFIG_NF_CONNTRACK_IPV6=m (if your setup supports IPv6) + + + + + nfnetlink: the generic messaging interface for Netfilter. + + + CONFIG_NETFILTER_NETLINK=m + + + + + nf_conntrack_netlink: the messaging interface for the Connection Tracking System. + + + CONFIG_NF_CT_NETLINK=m + + + + + connection tracking event notification API: the flow-based event notification interface. + + + CONFIG_NF_CONNTRACK_EVENTS=y + + + + + Verifying kernel support + + Make sure you have loaded nf_conntrack, nf_conntrack_ipv4 (if your setup also supports IPv6, nf_conntrack_ipv6) and nf_conntrack_netlink. + + + + + libnfnetlink: the netfilter netlink library use the official release available in netfilter.org + + + libnetfilter_conntrack: the netfilter netlink library use the official release available in netfilter.org + + + + + Installation + + To compile and install the conntrack-tools run the following commands: + + (non-root)$ tar xvjf conntrack-tools-x.x.x.tar.bz2 + (non-root)$ cd conntrack-tools-x.x.x + (non-root)$ ./configure --prefix=/usr + (non-root)$ make + (root) # make install + +Fedora Users + If you are installing the libraries in /usr/local/, do not forget to do the following things: + + PKG_CONFIG_PATH=/usr/local/lib/pkgconfig; export PKG_CONFIG_PATH + Add `/usr/local/lib' to your /etc/ld.so.conf file and run `ldconfig' + + Check `ldd' for trouble-shooting, read this for more information on how libraries work. + + +Verifying kernel support + To check that the modules are enabled in the kernel, run `conntrack -E' and generate traffic, you should see flow events reporting new connections and updates. + + + + + + Using conntrack: the command line interface + + The /proc/net/ip_conntrack interface is very limited as it only allows you to display the existing flows, their state and other information: + + + # cat /proc/net/ip_conntrack + tcp 6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=0 secmark=0 use=1 + tcp 6 431698 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34849 dport=993 packets=244 bytes=18723 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34849 packets=203 bytes=144731 [ASSURED] mark=0 secmark=0 use=1 + + +The command line tool conntrack can be used to display the same information: + + # conntrack -L + tcp 6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=0 secmark=0 use=1 + tcp 6 431698 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34849 dport=993 packets=244 bytes=18723 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34849 packets=203 bytes=144731 [ASSURED] mark=0 secmark=0 use=1 +conntrack v0.9.7 (conntrack-tools): 2 flow entries has been shown. + + +You can natively filter the output without using grep: + + # conntrack -L -p tcp --dport 34856 + tcp 6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=0 secmark=0 use=1 +conntrack v0.9.7 (conntrack-tools): 1 flow entries has been shown. + + +Update the mark based on a selection, this allows you to change the mark of an entry without using the CONNMARK target: + + # conntrack -U -p tcp --dport 3486 --mark 10 + tcp 6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=1 secmark=0 use=1 +conntrack v0.9.7 (conntrack-tools): 1 flow entries has been updated. + + +Delete one entry, this can be used to block traffic (you have to set /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal to zero). + + # conntrack -D -p tcp --dport 3486 + tcp 6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=1 secmark=0 use=1 +conntrack v0.9.7 (conntrack-tools): 1 flow entries has been deleted. + + +Display the connection tracking events: + + # conntrack -E + [NEW] udp 17 30 src=192.168.2.100 dst=192.168.2.1 sport=57767 dport=53 [UNREPLIED] src=192.168.2.1 dst=192.168.2.100 sport=53 dport=57767 + [UPDATE] udp 17 29 src=192.168.2.100 dst=192.168.2.1 sport=57767 dport=53 src=192.168.2.1 dst=192.168.2.100 sport=53 dport=57767 + [NEW] tcp 6 120 SYN_SENT src=192.168.2.100 dst=66.102.9.104 sport=33379 dport=80 [UNREPLIED] src=66.102.9.104 dst=192.168.2.100 sport=80 dport=33379 + [UPDATE] tcp 6 60 SYN_RECV src=192.168.2.100 dst=66.102.9.104 sport=33379 dport=80 src=66.102.9.104 dst=192.168.2.100 sport=80 dport=33379 + [UPDATE] tcp 6 432000 ESTABLISHED src=192.168.2.100 dst=66.102.9.104 sport=33379 dport=80 src=66.102.9.104 dst=192.168.2.100 sport=80 dport=33379 [ASSURED] + + +You can also display the existing flows in XML format, filter the output based on the NAT handling applied, etc. + + + + Setting up conntrackd: the daemon + + The daemon conntrackd supports two working modes: + + + + State table synchronization: the daemon can be used to synchronize the connection tracking state table between several firewall replicas. This can be used to deploy fault-tolerant stateful firewalls. This is the main feature of the daemon. + + + Flow-based statistics collection: the daemon can be used to collect flow-based statistics. This feature is similar to what ulogd-2.x provides. + + + + State table synchronization + + Requirements + + In order to get conntrackd working in synchronization mode, you have to fulfill the following requirements: + + + + A high availability manager like keepalived that manages the virtual IPs of the + firewall cluster, detects errors, and decide when to migrate the virtual IPs + from one firewall replica to another. Without it, conntrackd will not work appropriately. + + The state synchronization setup requires a working installation of keepalived, preferibly a recent version. Check if your distribution comes with a recent packaged version. Otherwise, you may compile it from the sources. + + + + There is a very simple example file in the conntrackd + sources to setup a simple HA cluster with keepalived (see the file + keepalived.conf under the doc/sync/ directory). This file can be used to + set up a simple VRRP cluster composed of two machines that hold the virtual + IPs 192.168.0.100 on eth0 and 192.168.1.100 on eth1. + + If you are not familiar with keepalived, please + read the official documentation available at the keepalived website + (http://www.keepalived.org). + +If you use a different high availability manager, make sure it works correctly before going ahead. + + + + + A dedicated link. The dedicated link between the firewalls is used + to transmit and receive the state information. The use of a dedicated link + is mandatory for security reasons as someone may pick the state information + that is transfered between the firewalls. + + + + A well-formed stateful rule-set. Otherwise you are likely to experience + problems during the fail-over. An example of a well-formed stateful iptables + rule-set is available in the conntrack-tools website. + + + + If your Linux kernel is < 2.6.22, you have to disable TCP window + tracking: + + # echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal + + + + + + + + + Configuring the daemon + + The daemon conntrackd in synchronization mode + supports up to three replication approaches: + + + + notrack: this approach is the most simple as + it is based on a best effort replication protocol, ie. unreliable + protocol. This protocol sends and receives the state information + without performing any specific checking. + + + + ft-fw: this approach is based on a reliable + protocol that performs message tracking. Thus, the protocol can recover + from message loss, re-ordering and corruption. + + + alarm: this approach is spamming. It is based + on a alarm-based protocol that periodically re-sends the flow state to + the backup firewall replicas. This protocol consumes a lot of bandwidth + but it resolves synchronization problems fast. + + + + The three existing approaches are soft real-time asynchronous + replication protocols that are aimed to have negligible impact in terms + of latency and bandwidth throughput in the stateful firewall filtering. + + To configure conntrackd in any of the existing + synchronization modes, you have to copy the example configuration file to + the directory /etc/conntrackd/ on every firewall replica. Note that + _type_ is the synchronization type selected. + + + (conntrack-tools-x.x.x)# cp doc/_type_/conntrackd.conf /etc/conntrackd/conntrackd.conf + + + + Do not forget to edit the files before going ahead. There are several + parameters that you have to tune to adapt the example configuration file + to your setup. + + +Configuration file location + If you don't want to put the config file under /etc/conntrackd/, just tell conntrackd where to find it passing the option -C. + + + + +Active-Backup setup + + In the Active-Backup setup, one of the stateful firewall replicas + filters traffic and the other acts as backup. If you use this approach, + you have to copy the script primary-backup.sh to: + + + + (conntrack-tools-x.x.x)# cp doc/sync/primary-backup.sh /etc/conntrackd/ + + + The HA manager invokes this script when a transition happens, ie. If + a stateful firewall replica: + + + + becomes active to recover the filtering. + + + becomes backup. + + + hits failure (this is available if the HA manager has a failure state, which is true for keepalived. + + + + The script is simple, and it contains the different actions that + conntrackd performs to recover the filtering or + purge obsolete entries from the state table, among others. The script is + commented, you can have a look at it if you need further information. + + + +Active-Active setup + + The Active-Active setup consists of having more than one stateful + firewall replicas actively filtering traffic. Thus, we reduce the resource + waste that implies to have a backup firewall which does nothing. + + We can classify the type of Active-Active setups in several + families: + + + + Symmetric path routing: The stateful firewall + replicas share the workload in terms of flows, ie. the packets that are + part of a flow are always filtered by the same firewall. + + + Asymmetric multi-path routing: The packets that + are part of a flow can be filtered by whatever stateful firewall in the + cluster. Thus, every flow-states have to be propagated to all the firewalls + in the cluster as we do not know which one would be the next to filter a + packet. This setup goes against the design of stateful firewalls as we + define the filtering policy based on flows, not in packets anymore. + + + + + As for 0.9.8, the design of conntrackd allows you + to deploy an symmetric Active-Active setup based on a static approach. + For example, assume that you have two virtual IPs, vIP1 and vIP2, and two + firewall replicas, FW1 and FW2. You can give the virtual vIP1 to the + firewall FW1 and the vIP2 to the FW2. + + + Unfortunately, you will have to wait for the support for the + Active-Active setup based on dynamic approach, ie. a workload sharing setup + without directors that allow the stateful firewall share the filtering. + + On the other hand, the asymmetric scenario may work if your setup + fulfills several strong assumptions. However, in the opinion of the author + of this work, the asymmetric setup goes against the design of stateful + firewalls and conntrackd. Therefore, you have two + choices here: you can deploy an Active-Backup setup or go back to your + old stateless rule-set (in that case, the conntrack-tools will not be + of any help anymore, of course). + + + +Launching conntrackd + + + Once you have configured conntrackd, you can run in + console mode which is an interactive mode, in that case + type 'conntrackd' as root. + + (root)# conntrackd + + If you want to run conntrackd in daemon + mode, then type: + + (root)# conntrackd -d + + You can verify that conntrackd is running by checking the log messages + via ps. Moreover, if conntrackd is + running fine, you can dump the current status of the daemon: + + + # conntrackd -s + cache internal: + current active connections: 4 + connections created: 4 failed: 0 + connections updated: 0 failed: 0 + connections destroyed: 0 failed: 0 + + cache external: + current active connections: 0 + connections created: 0 failed: 0 + connections updated: 0 failed: 0 + connections destroyed: 0 failed: 0 + + traffic processed: + 0 Bytes 0 Pckts + + multicast traffic: + 352 Bytes sent 0 Bytes recv + 22 Pckts sent 0 Pckts recv + 0 Error send 0 Error recv + + multicast sequence tracking: + 0 Pckts mfrm 0 Pckts lost + + + This command displays the number of entries in the internal and + external cache: + + + + The internal cache contains the states that this firewall replica is filtering, ie. this is a cache of the kernel state table. + + + + The external cache contains the states that the other firewall replica is filtering. + + + + + You can dump the internal cache with the following command: + + + # conntrackd -i + tcp 6 ESTABLISHED src=192.168.2.100 dst=139.174.175.20 sport=58491 dport=993 src=139.174.175.20 dst=192.168.2.100 sport=993 dport=58491 [ASSURED] mark=0 secmark=0 [active since 536s] + tcp 6 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=38211 dport=993 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=38211 [ASSURED] mark=0 secmark=0 [active since 536s] + tcp 6 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=38209 dport=993 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=38209 [ASSURED] mark=0 secmark=0 [active since 536s] + tcp 6 TIME_WAIT src=192.168.2.100 dst=74.125.45.166 sport=42593 dport=80 src=74.125.45.166 dst=192.168.2.100 sport=80 dport=42593 [ASSURED] [active since 165s] + tcp 6 ESTABLISHED src=192.168.2.100 dst=139.174.175.20 sport=37962 dport=993 src=139.174.175.20 dst=192.168.2.100 sport=993 dport=37962 [ASSURED] mark=0 secmark=0 [active since 536s] + + + You can dump the external cache with the following command: + + # conntrackd -e + + If the replication works fine, conntrackd -s + displays the active's internal cache should display the same number of + entries than the backup's external cache and vice-versa. + + To verify that the recovery works fine, if you trigger a fail-over, + the log files should display the following information: + + + [Thu Sep 18 18:03:02 2008] (pid=9759) [notice] committing external cache + [Thu Sep 18 18:03:02 2008] (pid=9759) [notice] Committed 1545 new entries + + This means that the state entries have been injected into the kernel correctly. + + + +Troubleshooting + + Problems with conntrackd? The following list + of questions should help for troubleshooting: + + + + + + + I see packets lost in conntrackd -s + + + + + You can rise the value of McastRcvSocketBuffer and McastRcvSocketBuffer, if the problem is due to buffer overruns in the multicast sender or the receiver, the problem should disapear. + + + + + + + + The log messages report that the maximum netlink socket buffer has been reached. + + + + + You can increase the values of SocketBufferSize and SocketBufferSizeMaxGrown. + + + + + + + + I see can't open multicast server in the log messages + + + + + Make sure that the IPv4_interface clause has the IP of the dedicated link. + + + + + + + + Can I use wackamole, heartattack or any other HA manager? + + + + + Absolutely, you can. But before reporting issues, make sure that your HA manager is not the source of the problems. + + + + + + + + + + + + + diff --git a/doc/manual/docbook.css b/doc/manual/docbook.css new file mode 100644 index 0000000..81f4016 --- /dev/null +++ b/doc/manual/docbook.css @@ -0,0 +1,43 @@ +/* stolen from "Making your DocBook/XML HTML output not suck" */ + +body { + font-family: luxi sans,sans-serif; +} + +.screen { + font-family: monospace; + font-size: 1em; + display: block; + padding: 10px; + border: 1px solid #bbb; + background-color: #eee; + color: #000; + overflow: auto; + border-radius: 2.5px; + -moz-border-radius: 2.5px; + margin: 0.5em 2em; +} + +.programlisting { + font-family: monospace; + font-size: 1em; + display: block; + padding: 10px; + border: 1px solid #bbb; + background-color: #ddd; + color: #000; + overflow: auto; + border-radius: 2.5px; + -moz-border-radius: 2.5px; + margin: 0.5em 2em; +} + +a { + text-decoration: none; + border-bottom: 1px dotted #000; +} + +a:hover { + background-color: #777; + color: #fff; +} -- cgit v1.2.3 From d70aed8f1d46a727c1b58df0b3bdf8d9ef219ffc Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 23 Feb 2009 10:20:48 +0100 Subject: doc: fix broken link to ulogd2 in the manual Reported-by: Ralf Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index e27eb46..50ae23f 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -228,7 +228,7 @@ conntrack v0.9.7 (conntrack-tools): 1 flow entries has been deleted. State table synchronization: the daemon can be used to synchronize the connection tracking state table between several firewall replicas. This can be used to deploy fault-tolerant stateful firewalls. This is the main feature of the daemon. - Flow-based statistics collection: the daemon can be used to collect flow-based statistics. This feature is similar to what ulogd-2.x provides. + Flow-based statistics collection: the daemon can be used to collect flow-based statistics. This feature is similar to what ulogd-2.x provides. -- cgit v1.2.3 From 46277c777841070a78d73179aebd6a18fd3f5f99 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 17 Jul 2009 12:18:19 +0200 Subject: conntrack: fix English typo in documentation This is an update to commit 575fc906a302599cb9afeb136096dfd96bb57b17. Signed-off-by: Jan Engelhardt Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index 50ae23f..b897318 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -181,14 +181,14 @@ # conntrack -L tcp 6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=0 secmark=0 use=1 tcp 6 431698 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34849 dport=993 packets=244 bytes=18723 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34849 packets=203 bytes=144731 [ASSURED] mark=0 secmark=0 use=1 -conntrack v0.9.7 (conntrack-tools): 2 flow entries has been shown. +conntrack v0.9.7 (conntrack-tools): 2 flow entries have been shown. You can natively filter the output without using grep: # conntrack -L -p tcp --dport 34856 tcp 6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=0 secmark=0 use=1 -conntrack v0.9.7 (conntrack-tools): 1 flow entries has been shown. +conntrack v0.9.7 (conntrack-tools): 1 flow entries have been shown. Update the mark based on a selection, this allows you to change the mark of an entry without using the CONNMARK target: -- cgit v1.2.3 From 7a12625004d261bcd292a75b036522f12840c027 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 10 May 2010 01:10:09 +0200 Subject: doc: description on how to block traffic with conntrack was incomplete This patch completes the documentation with the following discussion that took place in the mailing list. http://marc.info/?l=netfilter&m=127335152521674&w=2 Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index b897318..c3e8682 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -19,7 +19,7 @@ - 2008 + 2008-2010 Pablo Neira Ayuso @@ -198,7 +198,12 @@ conntrack v0.9.7 (conntrack-tools): 1 flow entries have been shown. conntrack v0.9.7 (conntrack-tools): 1 flow entries has been updated. -Delete one entry, this can be used to block traffic (you have to set /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal to zero). +Delete one entry, this can be used to block traffic if: + + You have a stateful rule-set that blocks traffic in INVALID state. + You have set /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_loose or /proc/sys/net/netfilter/nf_conntrack_tcp_loose, depending on your kernel version, to zero. + + # conntrack -D -p tcp --dport 3486 tcp 6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=1 secmark=0 use=1 -- cgit v1.2.3 From 1babf99896ac86aeedaa9b9bc33ef3ea004f9a3c Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 4 Aug 2010 19:14:14 +0200 Subject: conntrackd: minor documentation update (two new questions in the FAQ) This patch includes a minor documentation update with two new questions in the FAQ. Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index c3e8682..621b05f 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -37,7 +37,7 @@ This document details how to install and configure the conntrack-tools - 0.9.8. This software is under development, for that reason, it is likely + >= 0.9.8. This software is under development, for that reason, it is likely that this document will evolve in the future to cover new features and changes. @@ -571,6 +571,32 @@ conntrack v0.9.7 (conntrack-tools): 1 flow entries has been deleted. + + + + Does conntrackd support TCP flow-recovery with window tracking enabled? + + + + + Yes, but you require a Linux kernel >= 2.6.36 and the conntrack-tools >= 0.9.15. To enable it, check the TCPWindowTracking clause in the example configuration files. + + + + + + + + Does conntrackd support the H.323, SIP and NetBios connection tracking helpers? + + + + + No. This is not implemented yet, sorry. + + + + -- cgit v1.2.3 From 847971e3dd85ab5d061d6fb2792a8a16383e670b Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Sun, 16 Jan 2011 23:26:15 +0100 Subject: doc: update conntrack-tools manual This update adds to the documentation the following information: * add reference to "Demystifying cluster-based fault-tolerant firewalls" * add how-to disable the external cache * add how-to disable the internal cache * add how-to set the synchronization transport protocol * document iptables CT target * ask for sponsors to finish H323 and SIP support. Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 118 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 112 insertions(+), 6 deletions(-) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index 621b05f..8a4e15d 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -19,7 +19,7 @@ - 2008-2010 + 2008-2011 Pablo Neira Ayuso @@ -37,9 +37,9 @@ This document details how to install and configure the conntrack-tools - >= 0.9.8. This software is under development, for that reason, it is likely - that this document will evolve in the future to cover new features and - changes. + >= 0.9.15. This software is under development, for that reason, it is + likely that this document will evolve in the future to cover new features + and changes. @@ -346,6 +346,11 @@ conntrack v0.9.7 (conntrack-tools): 1 flow entries has been deleted. Active-Backup setup + Stateful firewall architectures + A good reading to extend the information about firewall architectures is Demystifying cluster-based fault-tolerant firewalls published in IEEE Internet Computing magazine. + + + In the Active-Backup setup, one of the stateful firewall replicas filters traffic and the other acts as backup. If you use this approach, you have to copy the script primary-backup.sh to: @@ -512,6 +517,106 @@ conntrack v0.9.7 (conntrack-tools): 1 flow entries has been deleted. +Other configuration options + + The daemon allows several configuration options that you may want to + enable. This section contains some information about them. + +Disabling external cache + + It is possible to disable the external cache. Thus, + conntrackd directly injects the flow-states into the + in-kernel Connection Tracking System of the backup firewall. You can do it + by enabling the DisableExternalCache option in the + conntrackd.conf configuration file: + + + +Sync { + Mode FTFW { + [...] + DisableExternalCache Off + } +} + + + You can also use this option with the NOTRACK and ALARM modes. This + increases CPU consumption in the backup firewall but now you do not need + to commit the flow-states during the master failures since they are already + in the in-kernel Connection Tracking table. Moreover, you save memory in + the backup firewall since you do not need to store the foreign flow-states + anymore. + + + + +Disabling internal cache + + You can also disable the internal cache by means of the + DisableInternalCache option in the + conntrackd.conf configuration file: + + + +Sync { + Mode NOTRACK { + [...] + DisableInternalCache Off + } +} + + + However, this option is only available for the NOTRACK mode. This + mode provides unreliable flow-state synchronization between firewalls. + Thus, if flow-states are lost during the synchronization, the protocol + provides no way to recover them. + + + + +Using UDP, TCP or multicast for flow-state synchronization + + You can use up to three different transport layer protocols to + synchronize flow-state changes between the firewalls: UDP, TCP and + Multicast. UDP and multicast are unreliable but together with the FT-FW + mode provide partial reliable flow-state synchronization. + + + The preferred choice is FT-FW over UDP, or multicast alternatively. + TCP introduces latency in the flow-state synchronization due to the + congestion control. Under flow-state message are lost, the FIFO delivery + becomes also a problem since the backup firewall quickly gets out of + sync. For that reason, its use is discouraged. Note that using TCP only + makes sense with the NOTRACK mode. + + + + + +Filtering Connection tracking events with iptables + + Since Linux kernel >= 2.6.34, iptables provides the + CT iptables target that allows to reduce the + amount of Connection Tracking events that are delivered to user-space. + The following example shows how to only generate the + assured event: + + + # iptables -I PREROUTING -t raw -j CT --ctevents assured + + + Assured flows + One flow is assured if the firewall has seen traffic for it in + both directions. + + + Reducing the amount of events generated helps to reduce CPU + consumption in the active firewall. + + + + + Troubleshooting Problems with conntrackd? The following list @@ -587,12 +692,13 @@ conntrack v0.9.7 (conntrack-tools): 1 flow entries has been deleted. - Does conntrackd support the H.323, SIP and NetBios connection tracking helpers? + Does conntrackd support the H.323 and SIP connection tracking helpers? - No. This is not implemented yet, sorry. + No. This is not implemented yet, sorry. If you are interested in + sponsoring this support, please contact me. -- cgit v1.2.3 From bbcdcc5fc45606081b41191b32891215f7f134e6 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 1 Feb 2011 00:26:12 +0100 Subject: doc: remove reference to the CT target Sorry, the iptables CT target is not yet ready for use until some patches are pushed to the Linux kernel. Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 23 ----------------------- 1 file changed, 23 deletions(-) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index 8a4e15d..affeb66 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -592,29 +592,6 @@ Sync { - -Filtering Connection tracking events with iptables - - Since Linux kernel >= 2.6.34, iptables provides the - CT iptables target that allows to reduce the - amount of Connection Tracking events that are delivered to user-space. - The following example shows how to only generate the - assured event: - - - # iptables -I PREROUTING -t raw -j CT --ctevents assured - - - Assured flows - One flow is assured if the firewall has seen traffic for it in - both directions. - - - Reducing the amount of events generated helps to reduce CPU - consumption in the active firewall. - - - Troubleshooting -- cgit v1.2.3 From 25fbcab361f64c03138d64e1ac15955dace571fd Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 18 Feb 2011 13:09:05 +0100 Subject: doc: document -s option of conntrackd in the manual Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 115 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 115 insertions(+) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index affeb66..b3f9617 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -680,6 +680,121 @@ Sync { + + + + Is there any way to set up a more verbose mode in the log message for debugging? + + + + + No, but conntrackd provides lots of information that you can look up in + runtime via -s option. + + You can check network statistics to find anomalies: + + # conntrackd -s network + network statistics: + recv: + Malformed messages: 0 + Wrong protocol version: 0 + Malformed header: 0 + Malformed payload: 0 + Bad message type: 0 + Truncated message: 0 + Bad message size: 0 + send: + Malformed messages: 0 + +sequence tracking statistics: + recv: + Packets lost: 42726 + Packets before: 0 + +UDP traffic (active device=eth3): + 564232 Bytes sent 1979844 Bytes recv + 2844 Pckts sent 8029 Pckts recv + 0 Error send 0 Error recv + + + You can check cache statistics: + +cache:internal active objects: 0 + active/total entries: 0/ 0 + creation OK/failed: 11068/ 0 + no memory available: 0 + no space left in cache: 0 + update OK/failed: 4128/ 0 + entry not found: 0 + deletion created/failed: 11068/ 0 + entry not found: 0 + +cache:external active objects: 0 + active/total entries: 0/ 0 + creation OK/failed: 10521/ 0 + no memory available: 0 + no space left in cache: 0 + update OK/failed: 8832/ 0 + entry not found: 0 + deletion created/failed: 10521/ 0 + entry not found: 0 + + + You can check runtime miscelaneous statistics: + +daemon uptime: 14 min + +netlink stats: + events received: 24736 + events filtered: 0 + events unknown type: 0 + catch event failed: 0 + dump unknown type: 0 + netlink overrun: 0 + flush kernel table: 1 + resync with kernel table: 0 + current buffer size (in bytes): 8000000 + +runtime stats: + child process failed: 0 + child process segfault: 0 + child process termsig: 0 + select failed: 0 + wait failed: 0 + local read failed: 0 + local unknown request: 0 + + + You can check dedicated link statistics: + +UDP traffic device=eth3 status=RUNNING role=ACTIVE: + 566848 Bytes sent 1982612 Bytes recv + 3018 Pckts sent 8203 Pckts recv + 0 Error send 0 Error recv + + + You can check network queue statistics: + +allocated queue nodes: 1 + +queue txqueue: +current elements: 0 +maximum elements: 2147483647 +not enough space errors: 0 + +queue errorq: +current elements: 0 +maximum elements: 128 +not enough space errors: 0 + +queue rsqueue: +current elements: 1 +maximum elements: 131072 +not enough space errors: 0 + + + + -- cgit v1.2.3 From c74b242213cbf9b26c9127dc3ce583e6a3cfdbc5 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 18 Feb 2011 13:18:09 +0100 Subject: doc: document redundant link support for conntrackd Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index b3f9617..08b5b95 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -592,6 +592,45 @@ Sync { +Redundant dedicated links + + You can set redundant dedicated links without using bonding, you have + to configure as many redundant links as you want in the configuration file. + In case of failure of the master dedicated link, conntrackd failovers to one + of the backups. An example of this configuration is the following: + + + +Sync { + Mode FTFW { + [...] + } + # default master dedicated link + UDP Default { + IPv4_address 192.168.2.1 + IPv4_Destination_Address 192.168.2.2 + Port 3780 + Interface eth3 + SndSocketBuffer 24985600 + RcvSocketBuffer 24985600 + Checksum on + } + # backup dedicated link + UDP { + IPv4_address 192.168.1.3 + IPv4_Destination_Address 192.168.1.4 + Port 3780 + Interface eth2 + SndSocketBuffer 24985600 + RcvSocketBuffer 24985600 + Checksum on + } + [...] +} + + + + Troubleshooting -- cgit v1.2.3 From 553cd1fa98a2e3eb88c0f08e961de8ca4cda5de1 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 22 Feb 2011 16:05:09 +0100 Subject: doc: add reference to the CT target again Now that we have fixed several aspects of the event filtering in 2.6.38, I reintroduce the documentation for this feature. Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index 08b5b95..64cb91f 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -631,6 +631,33 @@ Sync { + +Filtering Connection tracking events with iptables + + Since Linux kernel >= 2.6.34, iptables provides the + CT iptables target that allows to reduce the + amount of Connection Tracking events that are delivered to user-space. + However, you will have to use a Linux kernel >= 2.6.38 to profit + from this feature, since several aspects of the event filtering were + broken. + + The following example shows how to only generate the + assured event: + + + # iptables -I PREROUTING -t raw -j CT --ctevents assured + + + Assured flows + One flow is assured if the firewall has seen traffic for it in + both directions. + + + Reducing the amount of events generated helps to reduce CPU + consumption in the active firewall. + + + Troubleshooting -- cgit v1.2.3 From 0d8b44e82b71276f3987cbbcc6abe3d863b57d3c Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 22 Feb 2011 16:25:36 +0100 Subject: doc: add missing conntrackd -s invocation with options Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index 64cb91f..d71e889 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -759,7 +759,7 @@ Sync { You can check network statistics to find anomalies: - # conntrackd -s network +# conntrackd -s network network statistics: recv: Malformed messages: 0 @@ -785,6 +785,7 @@ UDP traffic (active device=eth3): You can check cache statistics: +# conntrackd -s cache cache:internal active objects: 0 active/total entries: 0/ 0 creation OK/failed: 11068/ 0 @@ -808,6 +809,7 @@ cache:external active objects: 0 You can check runtime miscelaneous statistics: +# conntrackd -s runtime daemon uptime: 14 min netlink stats: @@ -833,6 +835,7 @@ runtime stats: You can check dedicated link statistics: +# conntrackd -s link UDP traffic device=eth3 status=RUNNING role=ACTIVE: 566848 Bytes sent 1982612 Bytes recv 3018 Pckts sent 8203 Pckts recv @@ -841,6 +844,7 @@ UDP traffic device=eth3 status=RUNNING role=ACTIVE: You can check network queue statistics: +# conntrackd -s queue allocated queue nodes: 1 queue txqueue: -- cgit v1.2.3 From f5ac64e749b95da5c85410a1b6e20e5b3f852118 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Sun, 27 Feb 2011 02:46:52 +0100 Subject: doc: prepare 1.0.0 release in conntrack-tools manual Remove reference which states that this is still under development and refer to version 1.0.0. Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index d71e889..7ffb5ae 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -37,8 +37,7 @@ This document details how to install and configure the conntrack-tools - >= 0.9.15. This software is under development, for that reason, it is - likely that this document will evolve in the future to cover new features + >= 1.0.0. This document will evolve in the future to cover new features and changes. -- cgit v1.2.3 From 414fedd879fdc3cd0a910acd2fd9262251a6bfe7 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Sat, 7 Jan 2012 18:40:48 +0100 Subject: doc: update conntrack-tools manual to detail expectation support This patch updates the user manual on how to enable the expectation support for conntrackd. Signed-off-by: Pablo Neira Ayuso --- doc/manual/conntrack-tools.tmpl | 161 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 159 insertions(+), 2 deletions(-) (limited to 'doc/manual') diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl index 7ffb5ae..4936a76 100644 --- a/doc/manual/conntrack-tools.tmpl +++ b/doc/manual/conntrack-tools.tmpl @@ -657,6 +657,164 @@ Sync { +Synchronization of expectations + + The connection tracking system provides helpers that allows you to + filter multi-flow application protocols like FTP, H.323 and SIP among many + others. These protocols usually split the control and data traffic in + different flows. Moreover, the control flow usually announces layer 3 and + 4 information to let the other peer know where the data flows will be + open. This sort of protocols require that the firewall inspects the + content of the packet, otherwise filtering by layer 3 and 4 selectors + like addresses and ports become a real nightmare. Netfilter already + provides the so-called helpers that track this + protocol aspects to allow deploying appropriate filtering. These + helpers create expectation entries that + represent expected traffic that will arrive to the firewall according + to the inspected packets. + + In case that you have enabled tracking of these protocols, you + may want to enable the state-synchronization of expectation as well. + Thus, established flows for this specific protocols will not suffer + any disruption. + + To enable the expectation support in the configuration file, you + have to use the following option: + + +Sync { + ... + Options { + ExpectationSync { + ftp + sip + h323 + } + } +} + + The example above enables the synchronization of the expectations + for the FTP, SIP and H.323 helpers. + + In my testbed, there are two firewalls in a primary-backup + configuration running keepalived. They use a couple of floating cluster + IP address (192.168.0.100 and 192.168.1.100) that are used by the client. + These firewalls protect one FTP server (192.168.1.2) that will be accessed + by one client. + + In ASCII art, it looks like this: + + + 192.168.0.100 192.168.1.100 + eth1 eth2 + fw-1 + / \ FTP + client ------ ------ server + 192.168.0.2 \ / 192.168.1.2 + fw-2 + + + This is the rule-set for the firewalls: + + + -A FORWARD -m state --state RELATED -j ACCEPT + -A FORWARD -i eth2 -m state --state ESTABLISHED -j ACCEPT + -A FORWARD -i eth1 -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT + -A FORWARD -i eth1 -p tcp -m state --state ESTABLISHED -j ACCEPT + -A FORWARD -m state --state INVALID -j LOG --log-prefix "invalid: " + + Before going ahead, make sure nf_conntrack_ftp is + loaded. + + The following steps detail how to check that the expectation support + works fine with FTP traffic: + + + + Switch to the client. Start one FTP control connection to one + server that is protected by the firewalls, enter passive mode: + + + (term-1) user@client$ nc 192.168.1.2 21 + 220 dummy FTP server + USER anonymous + 331 Please specify the password. + PASS nothing + 230 Login successful. + PASV + 227 Entering Passive Mode (192,168,1,2,163,11). + + This means that port 163*256+11=41739 will be used for the data + traffic. I suggest you to read djb's FTP protocol description in case that you + don't understand how this calculation is done. + + + + Switch to fw-1 (primary) to check that the expectation is in the + internal cache. + + + root@fw1# conntrackd -i exp + proto=6 src=192.168.0.2 dst=192.168.1.2 sport=0 dport=41739 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.0.2 master-dst=192.168.1.2 sport=36390 dport=21 helper=ftp [active since 5s] + + + + + Switch to fw-2 (backup) to check that the expectation has been + successfully replicated. + + + root@fw2# conntrackd -e exp + proto=6 src=192.168.0.2 dst=192.168.1.2 sport=0 dport=41739 mask-src=255.255.255.255 mask-dst=255.255.255.255 sport=0 dport=65535 master-src=192.168.0.2 master-dst=192.168.1.2 sport=36390 dport=21 [active since 8s] + + + + + Make the primary firewall fw-1 fail. Now fw-2 becomes primary. + + + + Switch to fw-2 (primary) to commit the external cache into the + kernel. The logs should display that the commit was successful: + + + root@fw2# tail -100f /var/log/conntrackd.log + [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] committing external cache: expectations + [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] Committed 1 new entries + [Wed Dec 7 22:16:31 2011] (pid=19195) [notice] commit has taken 0.000366 seconds + + + + Switch to the client. Open a new terminal and connect to the port that + has been announced by the server: + + + (term-2) user@client$ nc -vvv 192.168.1.2 41739 + (UNKNOWN) [192.168.1.2] 41739 (?) open + + + + Switch to term-1 and ask for the file listing: + + + [...] + 227 Entering Passive Mode (192,168,1,2,163,11). + LIST + + + + Switch to term-2, it should display the listing. That means + everything has worked fine. + + + + + You may want to try disabling the expectation support and + repeating the steps to check that it does not work + without the state-synchronization. + + + Troubleshooting @@ -739,8 +897,7 @@ Sync { - No. This is not implemented yet, sorry. If you are interested in - sponsoring this support, please contact me. + Yes, conntrackd includes expectation support since version 1.2.0. -- cgit v1.2.3