Re: [PATCH] support --physdev-out for routed packets

[Patrick McHardy <kaber@trash.net>]

Philip Craig wrote:
> Patrick McHardy wrote:
> 
>>The thing I still don't get
>>is .. if you combine a bunch of devices in a bridge, why would you
>>care which port a packet will leave through? If you already know
>>behind which port something is reachable, why use a bridge? And if
>>you don't know I suppose you have nothing to filter by.
>>
> 
> 
> The devices in the bridge represent different security zones.
> Using a bridging firewall gives physical separation of these zones
> without requiring additional IP networks or configuration changes
> for the machines on those networks.  The security policy has rules
> defined primarily in terms of the zones, not the individual machines
> in those zones.  Matching on just IP address is not enough, because
> it does not enforce the physical separation.
> 
> We definitely could configure the firewall to know which address
> is behind which port, and enforce this in ebtables.  This is the
> solution Shorewall has used (I haven't looked to see if it enforces
> the ports).  But that requires more configuration.  Basically it is
> just a convenience argument.  I'll definitely be trying to migrate
> things to this setup though.


I believe multiple bridges would be the best choice here, you
get the seperation for free.