Re: RFC: Disable defered bridge hooks by default

[Tom Eastep <teastep@shorewall.net>]

[-- Attachment #1: Type: text/plain, Size: 1417 bytes --]

Patrick McHardy wrote:
> 
> On Thu, 13 Jul 2006, Tom Eastep wrote:
> 
>> Patrick McHardy wrote:
>>
>>>
>>> Thanks. I'm currently travelling, I'll look at this on Sunday when I get
>>> back home (haven't received it yet I think). Do you know on which
>>> criteria
>>> they filter in addition to the bridge port?
>>>
>>
>> Typically, they will also filter on protocol and the destination port
>> (if the
>> protocol is TCP or UDP).
> 
> 
> And the really differentiate between different bridge ports for this, i.e.
> port eth0 may receive packets on port 80, port eth1 may not?

That's correct.

> 
> I don't really see why this can't be done purely within ebtables, it too
> can filter based on protocol and port numbers. Do you also know of
> examples where its really necessary to filter on bridge port and use
> iptables' capabilities?
> 

In Shorewall, filtering on bridge port is usually done *first* to select the
appropriate rule chain. In that rule chain, the user has access to more or less
the full box of iptables tools (at least those that are supported by kernels
from kernel.org). To what extent those tools are actually used, I don't know.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 254 bytes --]