Brigde and Firewall with linux

Brigde and Firewall with linux

[Luca Scattin]

[-- Attachment #1: Type: text/plain, Size: 1429 bytes --]

Hello all.
I have a little problem to build a solution for a customer (an hotel).
I try to explai the situation with an ascii art
--------------
|      PC        |
|    Clent       |
-------------
        |  ip     
        |
--------------
|  Firewall     |
|   Bridge      |
-------------
        |
        |
        |192.168.0.254 (example)
--------------
|  router        |
|                   |
-------------
        | Public IP               
Internet

Client pc have your IP address and default gateway that it's impossible to change.
Bridge/Firewall have to accept all pachets with all ip adress (no problem... it' a bridge) and have to change the ip address of all packets in order to send correctly to the router.
I build the bridge correctly (I Think) with:
brctl addbr br0
brctl stp br0 off
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig eth0 0.0.0.0 up
ifconfig eth1 0.0.0.0 up
ifconfig bro 0.0.0.0 up
route add default gw 192.158.0.254
echo "1" > /proc/sys/net/ipv4/ip_forward

After that bridge is working.
I try to dump pachets in eth0 and eth1 and packest cross the bridge.

Noy I try to modify cleint packet address using SNAT
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 192.168.0.21 (example).
but in the second interface i view allvays the original client packets.... 
I mistake something but I don't know what.
I need help.
Thanks


Luca Scattin


[-- Attachment #2: Type: text/html, Size: 3589 bytes --]

Re: Brigde and Firewall with linux

[Cedric Blancher]

Le mer 03/12/2003 à 12:10, Luca Scattin a écrit :
> Noy I try to modify cleint packet address using SNAT
> iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 192.168.0.21
> (example).
> but in the second interface i view allvays the original client
> packets.... 
> I mistake something but I don't know what.

On 2.6 kernels, output interface will be br0, not eth0. So you'll have
to use physdev match in order to have your rule work :

	iptables -t nat -A POSTROUTING -m physdev --physdev-out eth1 \
		-j SNAT --to 192.168.0.21

I don't know if this behaviour has been backported to 2.4 kernels. At
least, you can try ;)

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread! 

Re: Brigde and Firewall with linux

[ONeill Jack]

 --- Cedric Blancher <blancher@cartel-securite.fr> a
écrit : 
> On 2.6 kernels, output interface will be br0, not
> eth0. So you'll have
> to use physdev match in order to have your rule work
> :
> 	iptables -t nat -A POSTROUTING -m physdev
> --physdev-out eth1 \
> 		-j SNAT --to 192.168.0.21
> 
> I don't know if this behaviour has been backported
> to 2.4 kernels. At
> least, you can try ;)

I thought you could only use the FORWARD CHAIN when
it's a bridge, because a bridge only passes packets
from one interface to another (?)

_________________________________________________________________
Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français !
Yahoo! Mail : http://fr.mail.yahoo.com

Re: Brigde and Firewall with linux

[Cedric Blancher]

Le jeu 11/12/2003 à 11:14, ONeill Jack a écrit :
> I thought you could only use the FORWARD CHAIN when
> it's a bridge, because a bridge only passes packets
> from one interface to another (?)

No, it also crosses PREROUTING and POSTROUTING. See ebtables
documentation, especially :

	http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!