Iptables – How to i prevent TINC from relaying DHCP

bridgedhcpiptablestincvpn

I am running tinc in several NAT routers running Debian 7 Wheezy, the VPN works fine for months, except because i've set it up in switch mode it relays DHCP requests and answers over all the VPN. The problem is that host A is using a Pool from 10.10.10.2-254 for DHCP, with 10.10.10.1 as gateway (host A), host B is using a Pool from 10.10.10.2-254 for DHCP with 10.10.20.1 as gateway (host B), and so on.

Please note that the tinc tap (ethernet) interface is bridged across the physical LAN interface, because the purpose of my "cloud" is to make ALL hosts in all networks (A,B ..) appear in the same LAN.

I am looking for a simple solution to overcome this. Tryed using iptables with physdev and physdev-in specifying the tinc interface but this doesen't seem to work.

Is there any other solution to this ?

P.S: switching tinc to router mode is not a solution as i really need multicast and other non-routable protocols.

Best Answer

It should work with iptables -t mangle -m physdev if you have the sysctl variable net.bridge.bridge-nf-call-iptables set to 1.

sysctl -w net.bridge.bridge-nf-call-iptables=1
iptables -t mangle -I PREROUTING -m physdev --physdev-in vpn1 \
    -p udp --dport 67:68 -j DROP


You also have the alternative to block it with ebtables:

## dont accept dhcp packets directed to the local machine
ebtables -A INPUT --in-interface vpn1 --protocol ipv4 \
    --ip-protocol udp --ip-destination-port 67:68 -j DROP

## dont forward dhcp packets coming in from vpn
ebtables -A FORWARD --in-interface vpn1 --protocol ipv4 \
    --ip-protocol udp --ip-destination-port 67:68 -j DROP

## dont send dhcp requests over vpn
ebtables -A FORWARD --out-interface vpn1 --protocol ipv4 \
   --ip-protocol udp --ip-destination-port 67:68 -j DROP
Related Topic