physdev match

physdev match

[Mohamed Eldesoky]

Ok, I got a stock kernel 2.4.27 patched with ebtables-bnrf, and
noticed that it has added physdev match.
But whenever I try to test a rule with -m physdev --physdev-in <int> 
it gives me

iptables: Invalid argument

Any special requirements to use it ??

-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: physdev match

[Aleksandar Milivojevic]

Mohamed Eldesoky wrote:
> Ok, I got a stock kernel 2.4.27 patched with ebtables-bnrf, and
> noticed that it has added physdev match.
> But whenever I try to test a rule with -m physdev --physdev-in <int> 
> it gives me
> 
> iptables: Invalid argument
> 
> Any special requirements to use it ??

Have you patched both userspace (iptables utility) and kernel?  This 
sounds like iptables utility wasn't patched.  Look into /lib/iptables 
directory and see what modules you have.

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7

Re: physdev match

[Mohamed Eldesoky]

I have this in that path.
libipt_physdev.so

However, I will try again.


On Thu, 23 Sep 2004 09:21:43 -0500, Aleksandar Milivojevic
<amilivojevic@pbl.ca> wrote:
> Mohamed Eldesoky wrote:
> > Ok, I got a stock kernel 2.4.27 patched with ebtables-bnrf, and
> > noticed that it has added physdev match.
> > But whenever I try to test a rule with -m physdev --physdev-in <int>
> > it gives me
> >
> > iptables: Invalid argument
> >
> > Any special requirements to use it ??
> 
> Have you patched both userspace (iptables utility) and kernel?  This
> sounds like iptables utility wasn't patched.  Look into /lib/iptables
> directory and see what modules you have.
> 
> --
> Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
> Systems Administrator                           1499 Buffalo Place
> Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7
> 
> 



-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: physdev match

[Mohamed Eldesoky]

Still the problem, doing

iptables -A INPUT -m physdev --physdev-in eth1 -j LOG

Gives me

iptables: Invalid argument


Any ideas !!!

On Thu, 23 Sep 2004 17:47:28 +0300, Mohamed Eldesoky
<eldesoky.lists@gmail.com> wrote:
> 
> 
> I have this in that path.
> libipt_physdev.so
> 
> However, I will try again.
> 
> On Thu, 23 Sep 2004 09:21:43 -0500, Aleksandar Milivojevic
> <amilivojevic@pbl.ca> wrote:
> > Mohamed Eldesoky wrote:
> > > Ok, I got a stock kernel 2.4.27 patched with ebtables-bnrf, and
> > > noticed that it has added physdev match.
> > > But whenever I try to test a rule with -m physdev --physdev-in <int>
> > > it gives me
> > >
> > > iptables: Invalid argument
> > >
> > > Any special requirements to use it ??
> >
> > Have you patched both userspace (iptables utility) and kernel?  This
> > sounds like iptables utility wasn't patched.  Look into /lib/iptables
> > directory and see what modules you have.
> >
> > --
> > Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
> > Systems Administrator                           1499 Buffalo Place
> > Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7
> >
> >
> 
> --
> Mohamed Eldesoky
> www.eldesoky.net
> RHCE
> 



-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

physdev match

[Axel Christiansen]

Hi,

is there a physdev-match patch for kernel 2.4.27
around? I really could need it for bridging. Somehow i
could not find it in patch-o-matic.

Thx, Axel

physdev match

[Mohamed Eldesoky]

Anyone know a patch for adding the physdev match to 2.4.21 kernels ?? RHEL3U3.

-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: physdev match

[Gavin Hamill]

On Wednesday 22 September 2004 11:53, Mohamed Eldesoky wrote:
> Anyone know a patch for adding the physdev match to 2.4.21 kernels ??
> RHEL3U3.

I have no idea what changes RHEL3 brings to the table, but in the 2.4 series 
no physdev match was required or necessary, because the 'bridge-nf' and later 
'ebtables' patches for 2.4.x. let "-i eth0" and friends work just fine on 
bridged devices, as if they were not bridged.

Cheers,
Gavin.

Re: physdev match

[Mohamed Eldesoky]

ummm
I was looking at the possibilities.
Also, what if I don't want to use ebtables !!


On Wed, 22 Sep 2004 11:58:19 +0100, Gavin Hamill <gdh@acentral.co.uk> wrote:
> On Wednesday 22 September 2004 11:53, Mohamed Eldesoky wrote:
> > Anyone know a patch for adding the physdev match to 2.4.21 kernels ??
> > RHEL3U3.
> 
> I have no idea what changes RHEL3 brings to the table, but in the 2.4 series
> no physdev match was required or necessary, because the 'bridge-nf' and later
> 'ebtables' patches for 2.4.x. let "-i eth0" and friends work just fine on
> bridged devices, as if they were not bridged.
> 
> Cheers,
> Gavin.
> 
> 



-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: physdev match

[Gavin Hamill]

On Wednesday 22 September 2004 12:01, Mohamed Eldesoky wrote:
> ummm
> I was looking at the possibilities.
> Also, what if I don't want to use ebtables !!

'ebtables' is just a round-all term for what became of the 'bridge 
firewalling' code. You don't need to use the 'ebtables' binary at all if all 
you want to do is apply firewall rules on a bridged system.

However, it remains to be seen whether the ebtables code would even patch 
successfully on an RHEL kernel source, plus if using a 'Real' Red Hat kernel 
is important to you, then you'll obviously not want to recompile at all.

Unless RHEL already contains the support (look for 'Bridge firewalling 
registered' in the 'dmesg' output from boot time) then you're a bit stuck.

Of course, all this talk of ebtables is now off topic =)

Cheers,
Gavin.

Re: physdev match

[Mohamed Eldesoky]

Well, the patch had some failures.
I saw it has the physdev in the patch !!


patching file include/linux/netfilter_ipv4/ipt_physdev.h

Will this patch add the physdev match ??
I am thinking about going with a stock kernel !!


On Wed, 22 Sep 2004 12:17:11 +0100, Gavin Hamill <gdh@acentral.co.uk> wrote:
> On Wednesday 22 September 2004 12:01, Mohamed Eldesoky wrote:
> > ummm
> > I was looking at the possibilities.
> > Also, what if I don't want to use ebtables !!
> 
> 'ebtables' is just a round-all term for what became of the 'bridge
> firewalling' code. You don't need to use the 'ebtables' binary at all if all
> you want to do is apply firewall rules on a bridged system.
> 
> However, it remains to be seen whether the ebtables code would even patch
> successfully on an RHEL kernel source, plus if using a 'Real' Red Hat kernel
> is important to you, then you'll obviously not want to recompile at all.
> 
> Unless RHEL already contains the support (look for 'Bridge firewalling
> registered' in the 'dmesg' output from boot time) then you're a bit stuck.
> 
> Of course, all this talk of ebtables is now off topic =)
> 
> Cheers,
> Gavin.
> 
> 



-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE