From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Vaidas M" Date: Sat, 20 Oct 2007 11:23:12 +0000 Subject: [LARTC] bridge or vlan Message-Id: <001001c8130b$99babfe0$cd303fa0$@lt> MIME-Version: 1 Content-Type: multipart/mixed; boundary="===============1119333065==" List-Id: To: lartc@vger.kernel.org This is a multipart message in MIME format. --===============1119333065== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0011_01C81324.BF07F7E0" Content-Language: lt This is a multipart message in MIME format. ------=_NextPart_000_0011_01C81324.BF07F7E0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hello to everyone, Here is the situation: [LAN1]---[eth3]/----------\ | LinuxBR |[eth2]---[LAN0]---[linuxGW]---[internet] [LAN2]---[eth4]\----------/ Whole LAN is in subnet 10.0.0.0/24. So I need: LAN0, LAN1, LAN2 could not see each other. LAN0, LAN1, LAN2 is in same subnet (10.0.0.0/24). All LANs have to get only internet. How can I configure LinuxBR to do so? Do I have to do only bridge? Or only vlan? Or both? Thanks. _ _ _ _ _ _ _ __ ___ ____ _____ Vaidas M. [Noxius] ------=_NextPart_000_0011_01C81324.BF07F7E0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hello to = everyone,

Here is = the situation:

[LAN1]---[eth3]/----------\

| LinuxBR = |[eth2]---[LAN0]---[linuxGW]---[internet]

[LAN2]---[eth4]\----------/

Whole LAN = is in subnet 10.0.0.0/24.

So I = need:

LAN0, = LAN1, LAN2 could not see each other.

LAN0, = LAN1, LAN2 is in same subnet (10.0.0.0/24).

All LANs = have to get only internet.

How can I = configure LinuxBR to do so?

Do I have = to do only bridge? Or only vlan? Or both?

Thanks.

_ = _ _ _ _ _ _ = __ ___ ____ _____

Vaidas = M. = [Noxius]

------=_NextPart_000_0011_01C81324.BF07F7E0-- --===============1119333065== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc --===============1119333065==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Pan'ko Alexander" Date: Sat, 20 Oct 2007 11:58:38 +0000 Subject: Re: [LARTC] bridge or vlan Message-Id: List-Id: References: <001001c8130b$99babfe0$cd303fa0$@lt> In-Reply-To: <001001c8130b$99babfe0$cd303fa0$@lt> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org On Sat, 20 Oct 2007 14:23:12 +0300 "Vaidas M" wrote: > Hello to everyone, > > > > Here is the situation: > > [LAN1]---[eth3]/----------\ > > | LinuxBR |[eth2]---[LAN0]---[linuxGW]---[internet] > > [LAN2]---[eth4]\----------/ > > Whole LAN is in subnet 10.0.0.0/24. > > > > So I need: > > LAN0, LAN1, LAN2 could not see each other. > > LAN0, LAN1, LAN2 is in same subnet (10.0.0.0/24). > > All LANs have to get only internet. > > > > How can I configure LinuxBR to do so? > > Do I have to do only bridge? Or only vlan? Or both? > On LinuxBR: iptables -A FORWARD -s 10.0.0.0/24 -d linuxGW_IP/32 -j ACCEPT iptables -A FORWARD -s 10.0.0.0/24 -d 10.0.0.0/24 -j DROP iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d linuxGW_IP/32 -j MASQUERADE On linuxGW: iptables -t nat -A POSTROUTING -s LinuxBR_IP/32 -j MASQUERADE -- With best regards, Pan'ko Alexander. _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc From mboxrd@z Thu Jan 1 00:00:00 1970 From: Grant Taylor Date: Mon, 22 Oct 2007 19:05:59 +0000 Subject: Re: [LARTC] bridge or vlan Message-Id: <471CF497.8020808@riverviewtech.net> List-Id: References: <001001c8130b$99babfe0$cd303fa0$@lt> In-Reply-To: <001001c8130b$99babfe0$cd303fa0$@lt> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org On 10/20/07 06:23, Vaidas M wrote: > Hello to everyone, > > Here is the situation: > > [LAN1]---[eth3]/----------\ > | LinuxBR |[eth2]---[LAN0]---[linuxGW]---[internet] > [LAN2]---[eth4]\----------/ > > Whole LAN is in subnet 10.0.0.0/24. > > So I need: > > LAN0, LAN1, LAN2 could not see each other. > LAN0, LAN1, LAN2 is in same subnet (10.0.0.0/24). > > All LANs have to get only internet. > > How can I configure LinuxBR to do so? > > Do I have to do only bridge? Or only vlan? Or both? This is very simple to do. Bridge all your LANs together (what ever interface you choose to use, physical and / or VLAN) and use EBTables to block forwarding of any traffic that has a source and destination on your 10.0.0.0/24 network. This will allow traffic from the LAN to the world and from the world to the LAN to be bridged, but not allow LAN to LAN traffic to be bridged. ebtables -t filter -A FORWARD --ip-src 10/24 --ip-dst 10/24 -j DROP This will block all IP traffic. Broadcasts and ARPs will get through, but can be stopped if you do want. If you do want broadcasts and ARPs to be stopped let me know and I'll propose some follow up rules to add to the above to stop them. Grant. . . . _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc From mboxrd@z Thu Jan 1 00:00:00 1970 From: Grant Taylor Date: Mon, 22 Oct 2007 22:34:21 +0000 Subject: Re: [LARTC] bridge or vlan Message-Id: <471D256D.1080904@riverviewtech.net> List-Id: References: <001001c8130b$99babfe0$cd303fa0$@lt> In-Reply-To: <001001c8130b$99babfe0$cd303fa0$@lt> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org On 10/22/07 15:50, Vaidas M wrote: > Thanks for your answer, this would help. You are welcome. > I think I know how to block arp: -p ARP -j DROP something like that, > ant the broadcasts: --pkttype-type ... Be careful blocking all ARP / broadcasts. Remember that equipment will need to ARP to find the router, at least from the two LANs that are not common with the router. You will probably want to allow ARPs to the router's IP address (and any other common equipment) and block all others. Grant. . . . _______________________________________________ LARTC mailing list LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc