From: Ron Peterson <rpeterso@mtholyoke.edu>
To: netfilter@lists.netfilter.org
Subject: Re: blocking dhcp on bridge
Date: Mon, 14 Feb 2005 17:09:13 -0500 [thread overview]
Message-ID: <20050214220913.GA21981@mtholyoke.edu> (raw)
In-Reply-To: <20050207185711.GA23991@mtholyoke.edu>
On Mon, Feb 07, 2005 at 01:57:11PM -0500, Ron Peterson wrote:
> On Sun, Feb 06, 2005 at 04:01:54PM -0500, Ron Peterson wrote:
>
> > I am running a dhcp server on a bridging firewall. The dhcp server runs
> > on br0. I have eth0 connected to my 'private' network, and eth1
> > connected to my 'public' network.
> >
> > I only want this dhcp server to service dhcp requests from the private
> > network. Any dhcp requests entering via eth1, or any dhcp replies being
> > sent via eth1 should be dropped.
I stopped using iptables, and used ebtables instead. Seems to work.
Obviously, there is some overlapping functionality between these two
toolsets. I'm learning the hard way when to use which tool.
$EBTABLES -A INPUT --in-interface $PUB --protocol IPv4 --ip-protocol udp --ip-source-port 68 -j DROP
$EBTABLES -A INPUT --in-interface $PUB --protocol IPv4 --ip-protocol udp --ip-destination-port 67 -j DROP
$EBTABLES -A FORWARD --in-interface $PRIV --protocol IPv4 --ip-protocol udp --ip-source-port 68 -j DROP
$EBTABLES -A FORWARD --in-interface $PUB --protocol IPv4 --ip-protocol udp --ip-destination-port 67 -j DROP
--
Ron Peterson
Network & Systems Manager
Mount Holyoke College
http://www.mtholyoke.edu/~rpeterso
prev parent reply other threads:[~2005-02-14 22:09 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-02-06 21:01 blocking dhcp on bridge Ron Peterson
2005-02-07 18:57 ` Ron Peterson
2005-02-14 22:09 ` Ron Peterson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20050214220913.GA21981@mtholyoke.edu \
--to=rpeterso@mtholyoke.edu \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.