Making a Bridging firewall

Making a Bridging firewall

[Dave Barnum]

Hello.. I've been wanting to rewrite my firewall for a little bit but 
i'm not that familiar with iptables..  Up until now i've had a shorewall 
based firewall that also did bridging between my gateway and a VPN 
gateway over the internet (to link our houses.)  I used the bridge-nf 
patch on the 2.4 kernel to be able to manage the bridge traffic and 
block certain broadcast packets (like DHCP)  I've now upgraded to the 
2.6 kernel because i heard it may fix some other issues i was having but 
now my bridge (DHCP blocking) rules no longer work... I'd like to get 
rid of shorewall and write my own IPTables in the hopes that i could get 
my ability to control the bridge back.  Can anyone make any suggestions, 
or point to a guide that does this with the 2.6 kernel?

Thanks

Re: Making a Bridging firewall

[Tom Eastep]

Dave Barnum wrote:
> Hello.. I've been wanting to rewrite my firewall for a little bit but 
> i'm not that familiar with iptables..  Up until now i've had a shorewall 
> based firewall that also did bridging between my gateway and a VPN 
> gateway over the internet (to link our houses.)  I used the bridge-nf 
> patch on the 2.4 kernel to be able to manage the bridge traffic and 
> block certain broadcast packets (like DHCP)  I've now upgraded to the 
> 2.6 kernel because i heard it may fix some other issues i was having but 
> now my bridge (DHCP blocking) rules no longer work... I'd like to get 
> rid of shorewall and write my own IPTables in the hopes that i could get 
> my ability to control the bridge back.  Can anyone make any suggestions, 
> or point to a guide that does this with the 2.6 kernel?

Shorewall 2.0.1 contains bridge/firewall support -- it works well with 
2.6 kernels.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

Re: Making a Bridging firewall

[Andrew Schulman]

> Hello.. I've been wanting to rewrite my firewall for a little bit but 
> i'm not that familiar with iptables..  Up until now i've had a shorewall 
> based firewall that also did bridging between my gateway and a VPN 
> gateway over the internet (to link our houses.)  I used the bridge-nf 
> patch on the 2.4 kernel to be able to manage the bridge traffic and 
> block certain broadcast packets (like DHCP)  I've now upgraded to the 
> 2.6 kernel because i heard it may fix some other issues i was having but 
> now my bridge (DHCP blocking) rules no longer work... I'd like to get 
> rid of shorewall and write my own IPTables in the hopes that i could get 
> my ability to control the bridge back.  Can anyone make any suggestions, 
> or point to a guide that does this with the 2.6 kernel?

I found "Linux Firewalls", 2nd ed., by Robert Ziegler, to be an 
excellent, complete guide to packet filter firewalls in general, and 
iptables in particular.  None of it is specific to kernel 2.4, as far as 
I'm aware.  After reading it I built my firewall with kernel 2.4, and it 
continues to work just fine in kernel 2.6.

I'm not familiar with the bridge-nf patch, but you might be able to 
implement your bridge using just the FORWARD table.

Good luck,
Andrew. 

-- 
To reply by email, replace "deadspam.com" by "alumni.utexas.net"

Re: Making a Bridging firewall

[Dave Barnum]

Tom Eastep wrote:

> Dave Barnum wrote:
>
>> Hello.. I've been wanting to rewrite my firewall for a little bit but 
>> i'm not that familiar with iptables..  Up until now i've had a 
>> shorewall based firewall that also did bridging between my gateway 
>> and a VPN gateway over the internet (to link our houses.)  I used the 
>> bridge-nf patch on the 2.4 kernel to be able to manage the bridge 
>> traffic and block certain broadcast packets (like DHCP)  I've now 
>> upgraded to the 2.6 kernel because i heard it may fix some other 
>> issues i was having but now my bridge (DHCP blocking) rules no longer 
>> work... I'd like to get rid of shorewall and write my own IPTables in 
>> the hopes that i could get my ability to control the bridge back.  
>> Can anyone make any suggestions, or point to a guide that does this 
>> with the 2.6 kernel?
>
>
> Shorewall 2.0.1 contains bridge/firewall support -- it works well with 
> 2.6 kernels.
>
> -Tom

Hmm, Perhaps i will give it a shot.  I was running into a problem with 
my current installation (1.4.8) where the "All All REJECT" policy would 
reject anything coming from the bridge (br0)  I could not figure out 
what rule/policy to add in to get it to work.. but when i did "ALL ALL 
ACCEPT" it would work fine.