All of lore.kernel.org
 help / color / mirror / Atom feed
From: Oscar Mechanic <oscar@ufomechanic.net>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] blocking traffic on the FORWARD chain using physdev
Date: Thu, 14 Dec 2006 12:26:37 +0000	[thread overview]
Message-ID: <1166099198.4538.101.camel@OSCARLAPLIN> (raw)
In-Reply-To: <4D411FB02758FE45915E9724339093F6152F0E@intranet.scpl.local>

Hi

   Physdev may no longer be supported soon something to do with hooks
and how this is difficult to support. I have stopped using it cause I
found some odd behavior in physdev-in, out seemed fine I remember. I use
ebtables and marks for this now.


On Thu, 2006-12-14 at 20:55 +0900, William Bohannan wrote:
> Currently using physdev on a bridge to try and isolate certain paths
> across and to the bridge.  It all works except when trying to stop the
> flow in one direction on the FORWARD chain?? Can someone please help??
> 
> Below is the testing done so far.
> 
> eth1 <---> BRIDGE <---> eth0
> 
> # Block (eth0 ---> eth1) - blocks both directions and not just one?? 
> iptables -A FORWARD -m physdev --physdev-out eth1 -p icmp -j DROP
> 
> # Block (eth0 <--- eth1) - blocks both directions and not just one??
> iptables -A FORWARD -m physdev --physdev-out eth1 -p icmp -j DROP
> 
> # Block (eth0 ---> BRIDGE) - working
> iptables -A INPUT -m physdev --physdev-in eth0 -p icmp -j DROP
> 
> # Block (eth0 <--- BRIDGE) - working
> iptables -A OUTPUT -m physdev --physdev-out eth0 -p icmp -j DROP
> 	
> # Block (eth1 ---> BRIDGE) - working
> iptables -A INPUT -m physdev --physdev-in eth1 -p icmp -j DROP
> 
> # Block (eth1 <--- BRIDGE) - working
> iptables -A OUTPUT -m physdev --physdev-out eth1 -p icmp -j DROP
> 
> 
> Kind Regards
> William 
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nlhttp://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

  reply	other threads:[~2006-12-14 12:26 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2006-12-14 11:55 [LARTC] blocking traffic on the FORWARD chain using physdev William Bohannan
2006-12-14 12:26 ` Oscar Mechanic [this message]
2006-12-14 12:34 ` William Bohannan
2006-12-14 12:41 ` Oscar Mechanic
2006-12-20 16:32 ` William Bohannan
2006-12-20 16:37 ` William Bohannan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1166099198.4538.101.camel@OSCARLAPLIN \
    --to=oscar@ufomechanic.net \
    --cc=lartc@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.