postrouting and mac address

postrouting and mac address

[Fabio Marcone]

Hi!
I have a router linux and I need to filter packets in postrouting chain 
using source mac address. But... in postrouting chain, what is source 
mac address? mac address of effective source of the packet or router 
interface mac address ?

Thanks in advance,
Fabio

Re: postrouting and mac address

[Julien Vehent]

On Tue, 21 Jul 2009 14:05:43 +0200, Fabio Marcone <fabio.marcone@duet.it>
wrote:
> Hi!
> I have a router linux and I need to filter packets in postrouting chain 
> using source mac address. But... in postrouting chain, what is source 
> mac address? mac address of effective source of the packet or router 
> interface mac address ?
> 
> Thanks in advance,
> Fabio

Hi Fabio,

I don't think you can filter packets in postrouting.
The only tables available in POSTROUTING are mangle and nat.

To filter packets in a router, I think you have to do it in the FORWARD
chain.

see: http://jengelh.medozas.de/images/nf-packet-flow.png

Julien

-- 
julien
http://jve.linuxwall.info/blog

Re: postrouting and mac address

[Fabio Marcone]

Hi!
there was a misunderstanding: "filter" I mean "recognize". I don't want 
to drop packets in postrouting, I know it is impossible, but I need to 
recognize in postrouting packet of a certain source (by mac address, not 
by ip).

I don't know when packets source mac address is modified by router.

Thanks,
Fabio
> Hi Fabio,
>
> I don't think you can filter packets in postrouting.
> The only tables available in POSTROUTING are mangle and nat.
>
> To filter packets in a router, I think you have to do it in the FORWARD
> chain.
>
> see: http://jengelh.medozas.de/images/nf-packet-flow.png
>
> Julien
>
>   

Re: postrouting and mac address

[Fabio Marcone]

I tried to add this debug rule:
iptables -t mangle -A POSTROUTING -o eth0 -m mac --mac-source 
00:e0:7d:ec:96:1b -j LOG --log-prefix "POST_MAC "

but I got this error:
ip_tables: mac match: bad hook_mask 0x10/0x7

so I can't recognize packets by mac source in postrouting chain, isn't it?

Fabio


Fabio Marcone wrote:
> Hi!
> there was a misunderstanding: "filter" I mean "recognize". I don't 
> want to drop packets in postrouting, I know it is impossible, but I 
> need to recognize in postrouting packet of a certain source (by mac 
> address, not by ip).
>
> I don't know when packets source mac address is modified by router.
>
> Thanks,
> Fabio

Re: postrouting and mac address

[Pascal Hambourg]

Hello,

Fabio Marcone a écrit :
> Hi!
> there was a misunderstanding: "filter" I mean "recognize". I don't want 
> to drop packets in postrouting, I know it is impossible,

It is possible (DROP exists in all tables), but should not be done.

> but I need to 
> recognize in postrouting packet of a certain source (by mac address, not 
> by ip).

Can't you MARK packets in earlier chains (PREROUTING or FORWARD) and use 
the mark in POSTROUTING ?

Re: postrouting and mac address

[Fabio Marcone]

>
> It is possible (DROP exists in all tables), but should not be done.
I know that drop is only in INPUT, FORWARD and OUTPUT chain...

> Can't you MARK packets in earlier chains (PREROUTING or FORWARD) and 
> use the mark in POSTROUTING ?

perhaps it is the only solution but I would to recognize packets in 
POSTROUTING to send them in a IMQ virtual interface.

Fabio

Re: postrouting and mac address

[Gáspár Lajos]

Fabio Marcone írta:
> perhaps it is the only solution but I would to recognize packets in 
> POSTROUTING to send them in a IMQ virtual interface.
Or maybe you can tell us what you really want...
I mean: What is the purpose of logging by mac in the POSTROUTING chain?

Swifty

Re: postrouting and mac address

[Pascal Hambourg]

Fabio Marcone a écrit :
> 
>> It is possible (DROP exists in all tables), but should not be done.
> I know that drop is only in INPUT, FORWARD and OUTPUT chain...

This is not quite correct. DROP is available in all tables and chains. 
However the "orthodoxy" is to do filtering only in the 'filter' table.

>> Can't you MARK packets in earlier chains (PREROUTING or FORWARD) and 
>> use the mark in POSTROUTING ?
> 
> perhaps it is the only solution but I would to recognize packets in 
> POSTROUTING to send them in a IMQ virtual interface.

What is the problem in using a mark to do this ?