Brouter basic question .

Brouter basic question .

[ratheesh k]

Hi ,

 i have a rule

           ebtables -t broute -A BROUTING -j ACCEPT .

So packet wont traverse any other chain ?  ( Prerouting , Input ,
Forward , Postrouting ) ???

Thanks,
Ratheesh

Re: Brouter basic question .

[Michele Petrazzo - Unipex]

ratheesh k ha scritto:
> Hi ,
>
>   i have a rule
>
>             ebtables -t broute -A BROUTING -j ACCEPT .
>
> So packet wont traverse any other chain ?  ( Prerouting , Input ,
> Forward , Postrouting ) ???
>

http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html

And

http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png

broute and iptables chains are different things.

Michele

Re: Brouter basic question .

[Jan Engelhardt]

On Tuesday 2010-03-30 16:22, Michele Petrazzo - Unipex wrote:

> ratheesh k ha scritto:
>> Hi ,
>>
>>  i have a rule
>>
>>            ebtables -t broute -A BROUTING -j ACCEPT .
>>
>> So packet wont traverse any other chain ?  ( Prerouting , Input ,
>> Forward , Postrouting ) ???
>>
>
> http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html
>
> And
>
> http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png
>
> broute and iptables chains are different things.

These graphics are outdated. Please see the one from
http://en.wikipedia.org/wiki/Iptables  instead (which represents modern 
kernels).

Re: Brouter basic question .

[John Haxby]

On 30/03/10 14:01, ratheesh k wrote:
> Hi ,
>
>   i have a rule
>
>             ebtables -t broute -A BROUTING -j ACCEPT .
>
> So packet wont traverse any other chain ?  ( Prerouting , Input ,
> Forward , Postrouting ) ???
>    

I thought this was obvious, but on second thoughts, it's probably not as 
obvious as all that

$ man ebtables
...
                          The targets DROP and ACCEPT have a special 
meaning in
               the broute table (these names are used instead of more  
descrip-
               tive  names  to keep the implementation generic).  DROP 
actually
               means the frame has to be routed, while ACCEPT means  
the  frame
               has  to  be bridged.

and in the diagram that Jan pointed to 
(http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg) 
it becomes clear: -J ACCEPT means that the frame goes to the ebtables 
nat table; DROP means it goes up into the network layer for iptables to 
play with.

You'll make life easier for yourself as well if you call layer two 
things "frames" and layer three things "packets".

jch