Hello,

I set up another user next to root on my OpenWRT router. I wanted it to act as a monitoring user for different traffic routing. I routed the specific traffic for the user like this:

iptables -t mangle -N TUNMARK
iptables -t mangle -A TUNMARK -j MARK --set-mark 2
iptables -t mangle -A TUNMARK -j CONNMARK --save-mark
iptables -t mangle -N RESTOREMARK
iptables -t mangle -A RESTOREMARK -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT -p TCP -m state --state NEW -m owner --uid-owner 1001 -j TUNMARK
iptables -t mangle -A OUTPUT -p TCP -m state --state ESTABLISHED,RELATED -m owner --uid-owner 1001 -j RESTOREMARK

Where 1001 is the uid of that user.

But when I ssh with that user, I cannot use any kind of tools like ping, traceroute or mtr, because it seems just root can use them on an OpenWRT build:

ping: permission denied (are you root?)

How can I fix this without messing up the whole system or creat security leaks? Is there a better way doing this maybe?

(Last edited by knuddel on 1 Oct 2013, 20:40)

ping is usually setuid on most Linux systems:
$ ls -l $(which ping)
-rwsr-xr-x 1 root root 35,712 Nov  8  2011 /bin/ping

That way it runs as root for any logged in user.

On OpenWRT ping is just a link to busybox:
# ls -l $(which ping)
lrwxrwxrwx    1 root     root             7 Sep  5 00:24 /bin/ping -> busybox

and you definitely don't want to make all of busybox setuid.

You could consider setting up sudo on your OpenWRT system. I don't know if this is common or even if there's a package for it.

Hello, thanks a lot for your answer, it doesnt happen often you get a get answer here, so thanks a lot for taking the time.

I am not a Linux pro, so I didnt know that. I read myself just into what "setuid" is, and what it does. And I now understand, that ping, tracroute and also mtr requiers t be run as root, because they need some raw socket access if I understand it right, thought I dont know why only root this can do.

So my problem wouldnt be solved with sudo, I also installed it btw on my router and tried it out. Of course it's no use for my problem, because it will me just let run these tools under other users, but always as root.

Maybe I should have had asked the topic differently, heres what I wanted to do, like I also wrote about:

I have two VPN connections on my router, tun0 and tun1. Also two ISP connections, one over the WAN port of my router, connected to a cable modem, and the other via NAT of another router.

So I want to be able to use ping/mtr/traceroute of all 4 connections. How do I do this, if they all run as root and I cant mangle them this way? Ping works fine if used for the tun devices via -i tun0/1, default always is wan, but I have no way of forcing the traffic through the 4th connection which uses an SNAT. How do I do this?

> ping, tracroute and also mtr requiers t be run as root, because they
> need some raw socket access if I understand it right, thought I dont
> know why only root this can do.
Because raw socket access lets programs inject packets at a lower level, which may be malicious to other devices on the network. So normally only root can do this.

> I have two VPN connections on my router, tun0 and tun1. Also two
> ISP connections, one over the WAN port of my router, connected to a
> cable modem, and the other via NAT of another router.
Can you show your interfaces and routing table? Output of 'ifconfig -a' and 'route -n'?

Ok, so for br-lan, eth1, tun0, tun1, you can force traffic through those interfaces using ping -I.

What was the 4th case? I think you mentioned an SNAT? Can you describe the network setup in more detail?

Actually br-lan is the 4th case, which isnt working. ping -I tun0/tun1/eth1 works fine. But doing a ping -I br-lan results in the problem waiting for a receive and nothing happens. My config for this 4th case is:

ip rule add fwmark 4 table vpn3
ip route add default via 192.168.1.2 dev br-lan table vpn3
iptables -t nat -A POSTROUTING -o br-lan -j SNAT --to 192.168.1.1
iptables -t mangle -A PREROUTING -s 192.168.1.11 -j MARK --set-mark 4

Where 1.11 is a client behind the router. This works without any problem. But how would I be able to use the 1.2 NAT on the router itself? ping -I br-lan ... doesnt work.

192.168.1.2 is the other router, 192.168.1.1 is br-lan on th OpenWRT router. 192.168.1.11 is a client behind the OpenWRT router.

(Last edited by knuddel on 5 Oct 2013, 16:29)

Seems the OpenWRT (busybox) ping doesn't have this, but on my Ubuntu machine, ping has a "-m mark" parameter:

       -m mark
              use  mark to tag the packets going out. This is useful for vari‐
              ety of reasons within the kernel such as using policy routing to
              select specific outbound processing.

Maybe you can get a full-featured ping and run 'ping -m 4 <ip>'?

You can also cheat and designate a remote IP as being your "1.2 test IP" and add it to the main routing table. For example to use 4.2.2.1:

route add -host 4.2.2.1 gw 192.168.1.2

and then any traffic to 4.2.2.1 will go through your second router. But that's a bit of a hack.

And then? How do I use that virtual host for the source of ping/mtr ect.

root@wndr:~# ping -I 4.2.2.1 heise.de
PING heise.de (193.99.144.80) from 4.2.2.1: 56 data bytes
ping: can't set multicast source interface

That doesnt work.

Also I rather dont want to use ping, I want to use mtr, traceroute and so on, ping is just a basic example.

(Last edited by knuddel on 5 Oct 2013, 18:53)

No, I mean, 4.2.2.1 is the *destination*. Because basic routing works by looking at the destination. So you can say that for 4.2.2.1, the first hop should be through 192.168.1.2.

route add -host 4.2.2.1 gw 192.168.1.2
ping 4.2.2.1  # without any -I, will go through 192.168.1.2

And? /: What does that help? Sorry, I am really a noob in this. How do I use that? What is my goal in pinging 4.2.2.1??

I thought you were just trying to check the connection through the second router. Otherwise, does the client 1.11 have internet access through 1.2?

Then I could just ping 192.168.1.2 anyway...? I want to check the routing between the 1.2 internet to SOME internet point... from the 1.1 router.

Of course the 1.11 has... but I dont have access to that client.

(Last edited by knuddel on 5 Oct 2013, 20:06)

I think I see what you're trying to do.

Can you do 'ping -I br-lan <ip>' and show the output of 'tcpdump -nlpi br-lan' while you do this?

Whats the command for logging it to a file, also tcpdump -nlpi br-lan is too bright, it would spam thausands of lines in a few seconds. How to I filter it to that specific event.

Add a protocol filter:
tcpdump -nlpi br-lan icmp

It triggers no event when I ping.

Hmm, but you said it works with tun0? It should be the same case.

Do you know how to use IRC? It might be easier to debug this via chat. I'm on freenode in #openwrt, same nickname.

blub bla bla blub, i tried several hours to open a chat with you there, you didnt accept. anyway...

ive added a tap device for this maybe thats easier and I could use ping -I tap1:

ip tuntap add tap1 mode tap
ip link set tap1 up
ip addr add 4.2.2.1/24 dev tap1

but how do I route all traffic now initiated FROM tap1 <-> to GO OVER the other router?

(Last edited by knuddel on 6 Oct 2013, 01:54)

You don't want a separate interface.. you want a way to tell the kernel that you want certain packets to go to a certain gateway, different from the default.

Did you try to get a full-featured ping and then 'ping -m 4'?

Edit: on IRC, send me a private message and I'll reply when I'm around. Sorry, I think our times won't align very well, I'm in UTC-4.

(Last edited by eigma on 6 Oct 2013, 05:53)

Please just tell me how to do this "but how do I route all traffic now initiated FROM tap1 <-> to GO OVER the other router?", how to set a gw for a specific interface.

I am not getting another ping, I wouldnt even know where and how to compile it than for mips, because like I said I dont want to use ping. And like I said, I tried several hours to open a DCC chat with you, you never accepted. But anyway, dcc chats never worked for me, I think you have to open a port for them to work or something.

(Last edited by knuddel on 6 Oct 2013, 20:12)

You can't initiate traffic "from" tap1 - either the traffic is from some other machine connected on tap1, or the traffic is from the local machine. "ping -I tap1" means to generate traffic from the local machine and send it *out* on tap1.

I think it would help if you looked at the way Linux handles network traffic. Here is a good diagram:
http://www.cs.unh.edu/cnrg/people/gherr … tth_sEc2.1

In the "Application generates network traffic" you need to somehow mark the traffic so that the "Looks up route destination" looks at that mark and chooses a specific destination. "ping -I tun0" is one way, and says to always send the traffic *out* on tun0. "ping -m 4" is another way, which means to place a fwmark on the application traffic, and then in the lookup, look at the fwmark and choose a destination.

Try adding a default gateway on br-lan with a higher metric than the default gateway on eth1. Then by default traffic should still go on eth1 but you might be able to chose br-lan using "-I br-lan". But you said you don't want to use ping or mtr, so does the application that you really want to use have a -I flag?

You need to do more debugging and trials on your own. While pinging, start "tcpdump" on br-lan and eth1 and see on which interface packets are going out. Adjust the routing tables. Try deleting the default gateway on eth1 and send all traffic through br-lan.

Sorry about the DCC chat, like I said, send me a private message or on #openwrt and I will reply when I am on IRC. If our time zones don't match, there's not much I can do about that..

Try adding a default gateway on br-lan with a higher metric than the default gateway on eth1. Then by default traffic should still go on eth1 but you might be able to chose br-lan using "-I br-lan". How do I do this.

If our time zones don't match, there's not much I can do about that.. o0 I am here, right? I was yesterday there, right. So how are we even on "different time zones"....

Also isnt there maybe a way of creating a "local client" on the router which acts as a simulated client.

(Last edited by knuddel on 6 Oct 2013, 20:18)