Doing Bridge with firewalling

Doing Bridge with firewalling

[Afshin Lamei]

Hi,
I want to make my linux box perform both bridging and firewalling(I mean 
filternig,Nat,etc.)
My linux box has 2 ethernet cards.
1- Is it necessary to disable ip address of both eth0 and eth1? if yes, how 
to do that?
2- When I try to add eth0 as an interface to the bridge (using brctl addif), 
It says : "eth0:Setting promiscuous mode." what does it mean?
thanks,
--afshin







_________________________________________________________________
Protect your PC - get McAfee.com VirusScan Online 
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

Re: Doing Bridge with firewalling

[Kevin McConnell]

--- Afshin Lamei <linux_st@hotmail.com> wrote:

> 1- Is it necessary to disable ip address of both
> eth0 and eth1? if yes, how 
> to do that?

how could you do NAT'ing if you removed the IP
addresses?

> 2- When I try to add eth0 as an interface to the
> bridge (using brctl addif), 
> It says : "eth0:Setting promiscuous mode." what does
> it mean?
> thanks,

It means that the interface will take all frames that
are traversing the network it's attached to, even if
they aren't supposed to be destined for the device.


=====
Kevin C. McConnell --RHCE-- <Red Hat Certified Engineer>

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

Re: Doing Bridge with firewalling

[Brad Chapman]

Mr. Lamei,

--- Afshin Lamei <linux_st@hotmail.com> wrote:
> Hi,
> I want to make my linux box perform both bridging and firewalling(I mean 
> filternig,Nat,etc.)
> My linux box has 2 ethernet cards.
> 1- Is it necessary to disable ip address of both eth0 and eth1? if yes, how 
> to do that?

Yes. You have to remove all addressing data from the config files your distro uses
to configure eth0 and eth1. Then you need to use a kernel with CONFIG_BRIDGE and the
netfilter-bridge patches applied, and you need the bridge-utils package installed.
Those thre items can be found at kernel.org and
http://www.math.leidenuniv.nl/~buytenh/bridge. The Red Hat 8.0 2.4.18-14 kernel has
the appropriate infrastructure present.

Once all these conditions have been satisifed, all you need is these commands
somewhere in your startup scripts:

modprobe bridge (if the bridging code is modular)
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
brctl stp br0 off
ifconfig br0 $IPADDR netmask $NETMASK up

> 2- When I try to add eth0 as an interface to the bridge (using brctl addif), 
> It says : "eth0:Setting promiscuous mode." what does it mean?

It means that brctl has used one of the netdevice ioctl()s to tell the kernel driver
to tell the NIC to accept all Ethernet frames traveling over the wire, regardless
of their destination. This is needed to make the bridge work; otherwise there would
be no bridge.

The website with the briding stuff has documents about bridging.

> thanks,
> --afshin
>

Brad


=====
Brad Chapman

Permanent e-mail: kakadu_croc@yahoo.com

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

Re: Doing Bridge with firewalling

[Kevin McConnell]

--- Brad Chapman <kakadu_croc@yahoo.com> wrote:
> Yes. You have to remove all addressing data from the
> config files your distro uses
> to configure eth0 and eth1. Then you need to use a
> kernel with CONFIG_BRIDGE and the
> netfilter-bridge patches applied, and you need the
> bridge-utils package installed.
> Those thre items can be found at kernel.org and
> http://www.math.leidenuniv.nl/~buytenh/bridge. The
> Red Hat 8.0 2.4.18-14 kernel has
> the appropriate infrastructure present.

I have a question though. If he removes all addressing
data, how can he do NAT'ing properly?


=====
Kevin C. McConnell --RHCE-- <Red Hat Certified Engineer>

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

Re: Doing Bridge with firewalling

[Stephen Frost]

[-- Attachment #1: Type: text/plain, Size: 914 bytes --]

* Kevin McConnell (kevymac@yahoo.com) wrote:
> 
> --- Brad Chapman <kakadu_croc@yahoo.com> wrote:
> > Yes. You have to remove all addressing data from the
> > config files your distro uses
> > to configure eth0 and eth1. Then you need to use a
> > kernel with CONFIG_BRIDGE and the
> > netfilter-bridge patches applied, and you need the
> > bridge-utils package installed.
> > Those thre items can be found at kernel.org and
> > http://www.math.leidenuniv.nl/~buytenh/bridge. The
> > Red Hat 8.0 2.4.18-14 kernel has
> > the appropriate infrastructure present.
> 
> I have a question though. If he removes all addressing
> data, how can he do NAT'ing properly?

The two havn't got anything to do with each other.  NATing is modifying
packets as they pass through the router.  Addressing is the IP address
and whatnot to access the firewall/router.  One does not require the
other.

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: Doing Bridge with firewalling

[Kevin McConnell]

--- Stephen Frost <sfrost@snowman.net> wrote:
> The two havn't got anything to do with each other. 
> NATing is modifying
> packets as they pass through the router.  Addressing
> is the IP address
> and whatnot to access the firewall/router.  One does
> not require the
> other.

This leads me to another question then. What are the
advantages of not having an IP address assigned to 
interface(s) of the firewall? Like for instance, if my
firewall was the gateway to the outside world, how
would I tell machines behind the firewall to get out
to the outside world if they didn't have a default
route pointing to the internal address of the
firewall? Also, how would packets that hit the
firewall get routed through the other side?


=====
Kevin C. McConnell --RHCE-- <Red Hat Certified Engineer>

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

Re: Doing Bridge with firewalling

[Stephen Frost]

[-- Attachment #1: Type: text/plain, Size: 1550 bytes --]

* Kevin McConnell (kevymac@yahoo.com) wrote:
> 
> --- Stephen Frost <sfrost@snowman.net> wrote:
> > The two havn't got anything to do with each other. 
> > NATing is modifying
> > packets as they pass through the router.  Addressing
> > is the IP address
> > and whatnot to access the firewall/router.  One does
> > not require the
> > other.
> 
> This leads me to another question then. What are the
> advantages of not having an IP address assigned to 
> interface(s) of the firewall? Like for instance, if my
> firewall was the gateway to the outside world, how
> would I tell machines behind the firewall to get out
> to the outside world if they didn't have a default
> route pointing to the internal address of the
> firewall? Also, how would packets that hit the
> firewall get routed through the other side?

A router is not a bridge.  The two are different things.  You're
thinking of things in terms of a 'router'.  In order for your computers
to reach the external network they have to go through a router, true.  A
firewall can be implemented as part of a router or as part of a bridge.
The only requirement being that the packets are required to pass through
the device.  If you implemented your firewall as a bridge then the
machines on the network wouldn't 'see' it, they would point their
default routes to the router on the opposite side of the bridge.

I think the critical point here is that you need to understand what a
bridge is and how it works and how it's different from a router.

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

RE: Doing Bridge with firewalling

[Ranjeet Shetye]

I think that we need to clearly define the terminology for Kevin.

Interface - this is a tricky definition. One can refer to the PHYSICAL
interface (i.e. ethernet port) as an interface. You can also refer to
the LOGICAL interface (i.e. the one to which you allocate an IP
address). These two are DIFFERENT. You _might_ be able to make things
clearer by using "<ethernet> port" for the physical interface, and "<ip>
interface" for the logical interface.

(PDU = protocol data unit)
The names used to refer to the unit of data transfer are different at
different layers:
Frames = layer 2 PDUs
Packets = layer 3 PDUs

Bridge - layer 2 device i.e. "link control" layer i.e. transfers frames
across physical interfaces.
Router - layer 3 device i.e. network later i.e. transfers packets across
logical interfaces.

When you selectively tranfer frames (layer 2 PDUs) across a bridge, its
called filtering (frames).
When you selectively transfer packets (layer 3 PDUs) across a firewall,
its called firewalling/packet filtering.

I think I got it right :D.

Hence when you downsize your (layer 3) router into a (layer 2) bridge,
your neo-bridge becomes a layer 2 entity and disappears from the layer 3
i.e. it is no longer visible at layer 3. Therefore no firewalling, no
NAT.

Ranjeet Shetye
Senior Software Engineer
Zultys Technologies
771 Vaqueros Avenue
Sunnyvale  CA  94085
USA
Ranjeet.Shetye@Zultys.com
http://www.zultys.com/

 


> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org 
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of 
> Stephen Frost
> Sent: Tuesday, December 31, 2002 12:54 PM
> To: Kevin McConnell
> Cc: Brad Chapman; Afshin Lamei; netfilter@lists.netfilter.org
> Subject: Re: Doing Bridge with firewalling
> 
> 
> * Kevin McConnell (kevymac@yahoo.com) wrote:
> > 
> > --- Stephen Frost <sfrost@snowman.net> wrote:
> > > The two havn't got anything to do with each other.
> > > NATing is modifying
> > > packets as they pass through the router.  Addressing
> > > is the IP address
> > > and whatnot to access the firewall/router.  One does
> > > not require the
> > > other.
> > 
> > This leads me to another question then. What are the 
> advantages of not 
> > having an IP address assigned to
> > interface(s) of the firewall? Like for instance, if my firewall was 
> > the gateway to the outside world, how would I tell machines 
> behind the 
> > firewall to get out to the outside world if they didn't 
> have a default
> > route pointing to the internal address of the
> > firewall? Also, how would packets that hit the
> > firewall get routed through the other side?
> 
> A router is not a bridge.  The two are different things.  
> You're thinking of things in terms of a 'router'.  In order 
> for your computers to reach the external network they have to 
> go through a router, true.  A firewall can be implemented as 
> part of a router or as part of a bridge. The only requirement 
> being that the packets are required to pass through the 
> device.  If you implemented your firewall as a bridge then 
> the machines on the network wouldn't 'see' it, they would 
> point their default routes to the router on the opposite side 
> of the bridge.
> 
> I think the critical point here is that you need to 
> understand what a bridge is and how it works and how it's 
> different from a router.
> 
> 	Stephen
> 

RE: Doing Bridge with firewalling

[Kevin McConnell]

--- Ranjeet Shetye <ranjeet.shetye@zultys.com> wrote:
> 
> I think that we need to clearly define the
> terminology for Kevin.

Yes, thank you! :) I am always up for learning new
things. So it was just done at layer 2 instead of
layer 3. I understand now. BUT, back to what the
original poster said. He said that he wanted to have
the bridge do firewalling and NAT'ing (If I read his
post correctly). So according to what is written
below, he can't do that... right? 

> Hence when you downsize your (layer 3) router into a
> (layer 2) bridge,
> your neo-bridge becomes a layer 2 entity and
> disappears from the layer 3
> i.e. it is no longer visible at layer 3. Therefore
> no firewalling, no
> NAT.


=====
Kevin C. McConnell --RHCE-- <Red Hat Certified Engineer>

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

Re: Doing Bridge with firewalling

[Stephen Frost]

[-- Attachment #1: Type: text/plain, Size: 807 bytes --]

* Kevin McConnell (kevymac@yahoo.com) wrote:
> --- Ranjeet Shetye <ranjeet.shetye@zultys.com> wrote:
> > I think that we need to clearly define the
> > terminology for Kevin.
> 
> Yes, thank you! :) I am always up for learning new
> things. So it was just done at layer 2 instead of
> layer 3. I understand now. BUT, back to what the
> original poster said. He said that he wanted to have
> the bridge do firewalling and NAT'ing (If I read his
> post correctly). So according to what is written
> below, he can't do that... right? 

That's what he was claiming but that's incorrect.  I've done it and I've
helped other people through the process of doing it.  The big thing is
to get the patch from the bridge homepage (if it hasn't been
incorporated into the main kernel yet).

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: Doing Bridge with firewalling

[Stephen Frost]

[-- Attachment #1: Type: text/plain, Size: 981 bytes --]

* Ranjeet Shetye (ranjeet.shetye@zultys.com) wrote:
> I think I got it right :D.

Unfortunately not quite.

> Hence when you downsize your (layer 3) router into a (layer 2) bridge,
> your neo-bridge becomes a layer 2 entity and disappears from the layer 3
> i.e. it is no longer visible at layer 3. Therefore no firewalling, no
> NAT.

See, this isn't entirely correct.  A bridge passes around ethernet
frames, yes, *but* that does *NOT* mean that it can't modify those
frames.  It can, in fact, modify those frames for NATing purposes.
It can also do full state-based firewalling by watching the frames go by
and doing exactly what netfilter does today.

There's also an eptables or some such out there for filtering based on
raw ethernet frames but basically everything in iptables will work too
with the right patches.  The only thing that won't is MASQ because your
ethernet interfaces don't have an IP address for MASQ to use, *however*,
you *CAN* to SNAT/DNAT/etc.

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: Doing Bridge with firewalling

[Toshihiro Sonoda]

hi,

What is eptables?
Where can I get the information about it.

toshihiro

----- Original Message ----- 
From: "Stephen Frost" <sfrost@snowman.net>
To: "Ranjeet Shetye" <ranjeet.shetye@zultys.com>
Cc: <netfilter@lists.netfilter.org>
Sent: Thursday, January 02, 2003 12:08 AM
Subject: Re: Doing Bridge with firewalling

* Ranjeet Shetye (ranjeet.shetye@zultys.com) wrote:
> I think I got it right :D.

Unfortunately not quite.

> Hence when you downsize your (layer 3) router into a (layer 2) bridge,
> your neo-bridge becomes a layer 2 entity and disappears from the layer 3
> i.e. it is no longer visible at layer 3. Therefore no firewalling, no
> NAT.

See, this isn't entirely correct.  A bridge passes around ethernet
frames, yes, *but* that does *NOT* mean that it can't modify those
frames.  It can, in fact, modify those frames for NATing purposes.
It can also do full state-based firewalling by watching the frames go by
and doing exactly what netfilter does today.

There's also an eptables or some such out there for filtering based on
raw ethernet frames but basically everything in iptables will work too
with the right patches.  The only thing that won't is MASQ because your
ethernet interfaces don't have an IP address for MASQ to use, *however*,
you *CAN* to SNAT/DNAT/etc.

 Stephen

Re: Doing Bridge with firewalling

[Stephen Frost]

[-- Attachment #1: Type: text/plain, Size: 196 bytes --]

* Toshihiro Sonoda (toshihiro@jp.fujitsu.com) wrote:
> What is eptables?
> Where can I get the information about it.

Sorry, ebtables: http://users.pandora.be/bart.de.schuymer/ebtables/

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: Doing Bridge with firewalling

[Kevin McConnell]

--- Stephen Frost <sfrost@snowman.net> wrote:
> I think the critical point here is that you need to
> understand what a
> bridge is and how it works and how it's different
> from a router.

Ah, that would be a confusing point for me. I am
guessing that an ethernet bridge would allow 2
different segments to talk to each other directly.


=====
Kevin C. McConnell --RHCE-- <Red Hat Certified Engineer>

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

Re: Doing Bridge with firewalling

[Arnt Karlsen]

On Tue, 31 Dec 2002 15:54:17 -0500, 
Stephen Frost <sfrost@snowman.net> wrote in message 
<20021231205417.GQ677@ns>:

> * Kevin McConnell (kevymac@yahoo.com) wrote:
> > 
> > --- Stephen Frost <sfrost@snowman.net> wrote:
> > > The two havn't got anything to do with each other. 
> > > NATing is modifying
> > > packets as they pass through the router.  Addressing
> > > is the IP address
> > > and whatnot to access the firewall/router.  One does
> > > not require the
> > > other.
> > 
> > This leads me to another question then. What are the
> > advantages of not having an IP address assigned to 
> > interface(s) of the firewall? Like for instance, if my
> > firewall was the gateway to the outside world, how
> > would I tell machines behind the firewall to get out
> > to the outside world if they didn't have a default
> > route pointing to the internal address of the
> > firewall? Also, how would packets that hit the
> > firewall get routed through the other side?
> 
> A router is not a bridge.  The two are different things.  You're
> thinking of things in terms of a 'router'.  In order for your
> computers to reach the external network they have to go through a
> router, true.  A firewall can be implemented as part of a router or as
> part of a bridge. The only requirement being that the packets are
> required to pass through the device.  If you implemented your firewall
> as a bridge then the machines on the network wouldn't 'see' it, they
> would point their default routes to the router on the opposite side of
> the bridge.
> 
> I think the critical point here is that you need to understand what a
> bridge is and how it works and how it's different from a router.
> 

..think of is as a relay.

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.