Hi everyone,
Im trying to sort out how to block OUTGOING traffic from my LAN (any LAN host) to specific host on internet.
For this test, Im using: 74.125.29.101 as the host that I want to block traffic to.
I have added this rule to default OpenWRT /etc/config/firewall (at the end of the file in case it matters):
config rule
option name 'Drop_outgoing_test'
option family 'ipv4'
option proto 'all'
option src '*'
option dest '*'
option dest_ip '74.125.29.101'
option target 'REJECT'
Restarted firewall:
root@OpenWrt:~# /etc/init.d/firewall restart
Test - it looks that the rule did NOT block outgoing traffic from LAN to 74.125.29.101. However, it blocked incoming traffic from 74.125.29.101.
Terminal 1:
root@lanhost1:~# curl 74.125.29.101
curl: (7) Failed to connect to 74.125.29.101 port 80: Connection refused
Terminal 2:
root@lanhost1:~# tcpdump -n host 74.125.29.101
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
15:21:04.491950 IP 192.168.1.194.44114 > 74.125.29.101.80: Flags [S], seq 1733053839, win 29200, options [mss 1460,sackOK,TS val 848699177 ecr 0,nop,wscale 6], length 0
15:21:04.492739 IP 74.125.29.101.80 > 192.168.1.194.44114: Flags [R.], seq 0, ack 1733053840, win 0, length 0
The following tcpdump tells me that traffic to 74.125.29.101 (SYN) have escaped.
Then, 74.125.29.101 did respond and only this response is rejected by the FW.
This is NOT what I want to achieve.
What I want is that (outgoing) traffic to the destination is REJECTED already by my router: 192.168.1.194.44114 > 74.125.29.101.80
If I get it right, u want me guys to replace my rule with this?
If so, I have already tried that and it worked the same as having ‘*‘. (so didnt really blocked outgoing traffic to 74.125.29.101).
I will give it a go anyway and capture tcpdump (later today)
config rule
option name 'Drop_outgoing_test'
option family 'ipv4'
option proto 'all'
option src 'lan'
option dest 'wan'
option dest_ip '74.125.29.101'
option target 'REJECT'
The reject actually came from inside your router. It builds a fake reject packet that appears to be from the remote site. The endpoint PC is expecting to see a response from the remote public IP. It would ignore a packet with a source of the router's IP.
If you were to tcpdump on the router wan, you will see that nothing is actually sent or received from the router to the Internet.
You can also see from the timestamps that the connection was rejected in less than 1 ms. It did not go to the Internet.
We should point out that this is not Everytime the case.
Like if a router sends you network or host unreachable, that icmp packet comes of course from a router and not with an address of the original target.
And the ICMP standard defines a message for "Host administratively prohibited" (i.e. your attempt to reach that host was blocked by this router's firewall) but it is not used in practice.