firewalling PPPOE stream without terminating it

firewalling PPPOE stream without terminating it

[Chris Friesen]

I've got a PPPOE DSL line coming into my house, and I and my roommates 
each terminate our own connection and get our own dynamic IP address.

With the recent bunch of viruses/worms, a couple of us were thinking 
about setting up a box as a transparent firewalling bridge.  The only 
tricky bit is that we don't want to terminate the PPPOE connection at 
that box, since that would then force us to do NAT/ipmasq.

Does anyone know of any way to filter the contents of a tunnelled packet 
(PPPOE in particular) using standard tools like ebtables/iptables?

The other possibility I had considered was a netfilter module that tied 
into the ebtables hooks and knew how to look inside the PPPOE packet, 
but then I wouldn't get the userspace interface from ebtables/iptables.

Chris

-- 
Chris Friesen                    | MailStop: 043/33/F10
Nortel Networks                  | work: (613) 765-0557
3500 Carling Avenue              | fax:  (613) 765-2986
Nepean, ON K2H 8E9 Canada        | email: cfriesen@nortelnetworks.com

Re: firewalling PPPOE stream without terminating it

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 966 bytes --]

Hi Chris!

On Fri, Sep 12, 2003 at 10:32:04AM -0400, Chris Friesen wrote:

> I've got a PPPOE DSL line coming into my house, and I and my roommates 
> each terminate our own connection and get our own dynamic IP address.

So how is this question related to either 
1) network development (netdev@oss.sgi.com)
2) linux-kernel development (linux-kernel@vger.kernel.org)

I would like to ask you this question at an apropriate mailinglist
(netfilter@lists.netfilter.org, or the lartc mailinglist [since the
assumption that you would need to do NAT in case you terminate the two
dsl lines is invalid an can be solved using policy routing + connmark]).

> Chris Friesen                    | MailStop: 043/33/F10

-- 
- Harald Welte <laforge@gnumonks.org>               http://www.gnumonks.org/
============================================================================
Programming is like sex: One mistake and you have to support it your lifetime

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: firewalling PPPOE stream without terminating it

[Chris Friesen]

Harald Welte wrote:

> So how is this question related to either 
> 1) network development (netdev@oss.sgi.com)
> 2) linux-kernel development (linux-kernel@vger.kernel.org)
> 
> I would like to ask you this question at an apropriate mailinglist
> (netfilter@lists.netfilter.org, or the lartc mailinglist

Sorry, my bad.

Thread continued on other list as suggested.

Chris

-- 
Chris Friesen                    | MailStop: 043/33/F10
Nortel Networks                  | work: (613) 765-0557
3500 Carling Avenue              | fax:  (613) 765-2986
Nepean, ON K2H 8E9 Canada        | email: cfriesen@nortelnetworks.com

Re: firewalling PPPOE stream without terminating it

[Chris Friesen]

Harald Welte wrote:

For those just joining, I'm trying to put a box between my DSL modem and 
my ethernet switch to enable me to filter up to 5 PPPoE streams.  Harald 
suggested I move the discussion to the proper lists.

> I would like to ask you this question at an apropriate mailinglist
> (netfilter@lists.netfilter.org, or the lartc mailinglist [since the
> assumption that you would need to do NAT in case you terminate the two
> dsl lines is invalid an can be solved using policy routing + connmark]).

Okay, so you're suggesting terminating all the connections on the new 
box and then using policy routing to forward the packets on to the 
appropriate address(es) on the internal side?  And since the PPPoE 
headers have been removed, I could then use standard iptables to do the 
filtering?

Chris





-- 
Chris Friesen                    | MailStop: 043/33/F10
Nortel Networks                  | work: (613) 765-0557
3500 Carling Avenue              | fax:  (613) 765-2986
Nepean, ON K2H 8E9 Canada        | email: cfriesen@nortelnetworks.com

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/