PacketFence - BTS - PacketFence
View Issue Details
0001334PacketFenceconfigurationpublic2011-11-15 08:402012-10-23 14:38
0001334: Routed mode DNS entry duplication in iptables
During launch packetfence generates the iptables rules before sending them to iptables. During this generation it goes through all the routed networks managed by packetfence. In my case I have 300 routed networks, all of them need to be defined with DNS so that clients also get the address via DHCP. For all my networks the name servers are the same; however packetfence generates 300(*2) lines in iptables to allow domain lookup from the internet. Instead of only allowing each permitted nameserver once.
I had this sorted alright in the beta before upgrading to 3.0.1 release, but it was a very sloppy hack to verify the DNS ips for each network and omitting the line if it matched.
No tags attached.
? iptables.conf (131,248) 2011-11-16 07:42
Issue History
2011-11-15 08:40qzxNew Issue
2011-11-15 09:02obilodeauNote Added: 0002443
2011-11-16 07:42qzxFile Added: iptables.conf
2011-11-16 07:47qzxNote Added: 0002446
2012-10-19 12:45fgaudreaultTarget Version => investigate
2012-10-23 14:38fgaudreaultNote Added: 0003230
2012-10-23 14:38fgaudreaultStatusnew => resolved
2012-10-23 14:38fgaudreaultResolutionopen => fixed
2012-10-23 14:38fgaudreaultAssigned To => fgaudreault
2012-10-23 14:38fgaudreaultTarget Versioninvestigate =>

2011-11-15 09:02   
Can you post your iptables config? The generated iptables config is in /usr/local/pf/var/conf/iptables.conf.
2011-11-16 07:47   
I've uploaded the iptables.conf as it used to look like. I have modified the iptables template configuration file to be more efficient and include the necessary rules.

This one looks like it used to but is not directly generated by the iptables library. This could probably be solved with a slight modification of /usr/local/pf/lib/pf/ I reckon. Empty hash, attempt to match dns statement to hash, add it if it doesn't match, ignore if it does; generate forward rules after processing all routed networks in network configuration?
2012-10-23 14:38   
This was fixed at some point. I cannot reproduced using 3.6.0-devel.