From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Luca Scattin" Subject: Brigde and Firewall with linux Date: Wed, 3 Dec 2003 12:10:55 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <007c01c3b98e$1f5e3c70$1e00a8c0@MERCURIO> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0079_01C3B996.810112B0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0079_01C3B996.810112B0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello all. I have a little problem to build a solution for a customer (an hotel). I try to explai the situation with an ascii art -------------- | PC | | Clent | ------------- | ip =20 | -------------- | Firewall | | Bridge | ------------- | | |192.168.0.254 (example) -------------- | router | | | ------------- | Public IP =20 Internet Client pc have your IP address and default gateway that it's impossible = to change. Bridge/Firewall have to accept all pachets with all ip adress (no = problem... it' a bridge) and have to change the ip address of all = packets in order to send correctly to the router. I build the bridge correctly (I Think) with: brctl addbr br0 brctl stp br0 off brctl addif br0 eth0 brctl addif br0 eth1 ifconfig eth0 0.0.0.0 up ifconfig eth1 0.0.0.0 up ifconfig bro 0.0.0.0 up route add default gw 192.158.0.254 echo "1" > /proc/sys/net/ipv4/ip_forward After that bridge is working. I try to dump pachets in eth0 and eth1 and packest cross the bridge. Noy I try to modify cleint packet address using SNAT iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 192.168.0.21 = (example). but in the second interface i view allvays the original client = packets....=20 I mistake something but I don't know what. I need help. Thanks Luca Scattin ------=_NextPart_000_0079_01C3B996.810112B0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hello all.
I have a little problem to build a = solution for a=20 customer (an hotel).
I try to explai the situation with an = ascii=20 art
--------------
|     =20 PC        |
|   =20 Clent      =20 |
-------------
        |  = ip     
      &= nbsp;=20 |
--------------
|  Firewall    =20 |
|   Bridge     =20 |
-------------
       =20 |
       =20 |
        |192.168.0.254=20 (example)
--------------
| =20 router       =20 |
|           &= nbsp;      =20 |
-------------
        = | Public=20 IP            = ;  =20
Internet
 
Client pc have your IP address and = default gateway=20 that it's impossible to change.
Bridge/Firewall have to accept all = pachets with all=20 ip adress (no problem... it' a bridge) and have to change the ip address = of all=20 packets in order to send correctly to the router.
I build the bridge correctly (I Think)=20 with:
brctl addbr br0
brctl stp br0 off
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig eth0 0.0.0.0 up
ifconfig eth1 0.0.0.0 up
ifconfig bro 0.0.0.0 up
route add default gw = 192.158.0.254
echo "1" >=20 /proc/sys/net/ipv4/ip_forward
 
After that bridge is = working.
I try to dump pachets in eth0 and eth1 = and packest=20 cross the bridge.
 
Noy I try to modify cleint packet = address using=20 SNAT
iptables -t nat -A POSTROUTING -o eth1 = -j SNAT --to=20 192.168.0.21 (example).
but in the second interface i view = allvays the=20 original client packets....
I mistake something but I don't know=20 what.
I need help.
Thanks

 
Luca = Scattin

------=_NextPart_000_0079_01C3B996.810112B0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cedric Blancher Subject: Re: Brigde and Firewall with linux Date: Thu, 11 Dec 2003 09:48:15 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1071132494.781.19.camel@elendil.intranet.cartel-securite.net> References: <007c01c3b98e$1f5e3c70$1e00a8c0@MERCURIO> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <007c01c3b98e$1f5e3c70$1e00a8c0@MERCURIO> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: Luca Scattin Cc: netfilter@lists.netfilter.org Le mer 03/12/2003 =E0 12:10, Luca Scattin a =E9crit : > Noy I try to modify cleint packet address using SNAT > iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 192.168.0.21 > (example). > but in the second interface i view allvays the original client > packets....=20 > I mistake something but I don't know what. On 2.6 kernels, output interface will be br0, not eth0. So you'll have to use physdev match in order to have your rule work : iptables -t nat -A POSTROUTING -m physdev --physdev-out eth1 \ -j SNAT --to 192.168.0.21 I don't know if this behaviour has been backported to 2.4 kernels. At least, you can try ;) --=20 http://www.netexit.com/~sid/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE >> Hi! I'm your friendly neighbourhood signature virus. >> Copy me to your signature file and help me spread!=20 From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?iso-8859-1?q?ONeill=20Jack?= Subject: Re: Brigde and Firewall with linux Date: Thu, 11 Dec 2003 11:14:46 +0100 (CET) Sender: netfilter-admin@lists.netfilter.org Message-ID: <20031211101446.16719.qmail@web25207.mail.ukl.yahoo.com> References: <1071132494.781.19.camel@elendil.intranet.cartel-securite.net> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <1071132494.781.19.camel@elendil.intranet.cartel-securite.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: Cedric Blancher , Luca Scattin Cc: netfilter@lists.netfilter.org --- Cedric Blancher a =E9crit=A0:=20 > On 2.6 kernels, output interface will be br0, not > eth0. So you'll have > to use physdev match in order to have your rule work > : > iptables -t nat -A POSTROUTING -m physdev > --physdev-out eth1 \ > -j SNAT --to 192.168.0.21 >=20 > I don't know if this behaviour has been backported > to 2.4 kernels. At > least, you can try ;) I thought you could only use the FORWARD CHAIN when it's a bridge, because a bridge only passes packets from one interface to another (?) _________________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en fran=E7ais ! Yahoo! Mail : http://fr.mail.yahoo.com From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cedric Blancher Subject: Re: Brigde and Firewall with linux Date: Thu, 11 Dec 2003 11:49:52 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1071139792.796.114.camel@elendil.intranet.cartel-securite.net> References: <20031211101446.16719.qmail@web25207.mail.ukl.yahoo.com> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <20031211101446.16719.qmail@web25207.mail.ukl.yahoo.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: ONeill Jack Cc: Luca Scattin , netfilter@lists.netfilter.org Le jeu 11/12/2003 =E0 11:14, ONeill Jack a =E9crit : > I thought you could only use the FORWARD CHAIN when > it's a bridge, because a bridge only passes packets > from one interface to another (?) No, it also crosses PREROUTING and POSTROUTING. See ebtables documentation, especially : http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png --=20 http://www.netexit.com/~sid/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE >> Hi! I'm your friendly neighbourhood signature virus. >> Copy me to your signature file and help me spread!=20