Re: Policy match with a bridge

[Tom Eastep <teastep@shorewall.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Patrick McHardy wrote:
| Tom Eastep wrote:
|
|> -----BEGIN PGP SIGNED MESSAGE-----
|> Hash: SHA1
|>
|> I'm seeing odd behavior of policy match when used with a bridge.
|>
|> wookie:/backup # uname -a
|> Linux wookie 2.6.5-7.104-default #1 Wed Jul 28 16:42:13 UTC 2004 i586
|> i586 i386 GNU/Linux
|
|
| Have you applied the ipsec+netfilter patches ? Without them, packets are
| only seen encrypted in the OUTPUT chain.
|
Yes -- the ipsec+netfilter patches are applied. Here is the same test
with the bridge removed and the local ip address transfered to one of
the network cards:

wookie:~ # iptables -L -n -v
Chain INPUT (policy ACCEPT 137 packets, 18014 bytes)
~ pkts bytes target     prot opt in     out     source
destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
~ pkts bytes target     prot opt in     out     source
destination

Chain OUTPUT (policy ACCEPT 100 packets, 14110 bytes)
~ pkts bytes target     prot opt in     out     source
destination
wookie:~ # iptables -A OUTPUT -m policy --pol ipsec --dir out -j ACCEPT
wookie:~ # ping tipper
PING tipper.shorewall.net (192.168.1.8) 56(84) bytes of data.
64 bytes from tipper.shorewall.net (192.168.1.8): icmp_seq=1 ttl=64
time=4.19 ms
64 bytes from tipper.shorewall.net (192.168.1.8): icmp_seq=2 ttl=64
time=3.45 ms
64 bytes from tipper.shorewall.net (192.168.1.8): icmp_seq=3 ttl=64
time=3.49 ms
64 bytes from tipper.shorewall.net (192.168.1.8): icmp_seq=4 ttl=64
time=3.32 ms

- --- tipper.shorewall.net ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3002ms
rtt min/avg/max/mdev = 3.327/3.617/4.195/0.339 ms
wookie:~ # iptables -L -n -v
Chain INPUT (policy ACCEPT 482 packets, 50100 bytes)
~ pkts bytes target     prot opt in     out     source
destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
~ pkts bytes target     prot opt in     out     source
destination

Chain OUTPUT (policy ACCEPT 269 packets, 36010 bytes)
~ pkts bytes target     prot opt in     out     source
destination
~   28  3376 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0           policy match dir out pol ipsec

wookie:~ #

- -Tom
- --
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBH3uHO/MAbZfjDLIRAvIhAJ4x6l+LJ7pSp/vnrqHlSeOidn0oAACgrZv6
Xrm70xeiqgHYKOle8YSce14=
=ZChs
-----END PGP SIGNATURE-----