From: Grant Taylor <gtaylor@riverviewtech.net>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] bridge or vlan
Date: Mon, 22 Oct 2007 19:05:59 +0000 [thread overview]
Message-ID: <471CF497.8020808@riverviewtech.net> (raw)
In-Reply-To: <001001c8130b$99babfe0$cd303fa0$@lt>
On 10/20/07 06:23, Vaidas M wrote:
> Hello to everyone,
>
> Here is the situation:
>
> [LAN1]---[eth3]/----------\
> | LinuxBR |[eth2]---[LAN0]---[linuxGW]---[internet]
> [LAN2]---[eth4]\----------/
>
> Whole LAN is in subnet 10.0.0.0/24.
>
> So I need:
>
> LAN0, LAN1, LAN2 could not see each other.
> LAN0, LAN1, LAN2 is in same subnet (10.0.0.0/24).
>
> All LANs have to get only internet.
>
> How can I configure LinuxBR to do so?
>
> Do I have to do only bridge? Or only vlan? Or both?
This is very simple to do. Bridge all your LANs together (what ever
interface you choose to use, physical and / or VLAN) and use EBTables to
block forwarding of any traffic that has a source and destination on
your 10.0.0.0/24 network. This will allow traffic from the LAN to the
world and from the world to the LAN to be bridged, but not allow LAN to
LAN traffic to be bridged.
ebtables -t filter -A FORWARD --ip-src 10/24 --ip-dst 10/24 -j DROP
This will block all IP traffic. Broadcasts and ARPs will get through,
but can be stopped if you do want. If you do want broadcasts and ARPs
to be stopped let me know and I'll propose some follow up rules to add
to the above to stop them.
Grant. . . .
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
next prev parent reply other threads:[~2007-10-22 19:05 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-10-20 11:23 [LARTC] bridge or vlan Vaidas M
2007-10-20 11:58 ` Pan'ko Alexander
2007-10-22 19:05 ` Grant Taylor [this message]
2007-10-22 22:34 ` Grant Taylor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=471CF497.8020808@riverviewtech.net \
--to=gtaylor@riverviewtech.net \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.