Bridge/VPN question.

["Anthony R. Vallario" <avallario@tecmasters.com>]

[-- Attachment #1: Type: text/plain, Size: 1413 bytes --]

I hope you all can help. Ok, here's the setup


Internet: eth0
Lan: eth1
Tunnel: tap0
Bridge: br0 (tap0<->eth1)


I have the firewall setup to be a gateway/router to the internet, and to the private offsite lan thru the tunnel. Everything works great, minus one thing.

I have FORWARD/OUTPUT rules for not letting certain traffic out to the internet. Mainly virus traffic and use of other mail servers. Only problem is they aren't working. Here are the rules:


iptables -A FORWARD -o eth0 -p tcp -m tcp -d <approved mail server> --dport 25 -j ACCEPT
iptables -A FORWARD -o eth0 -p tcp -m tcp --dport 25 -j DROP
iptables -A OUTPUT -o eth0 -p tcp -m tcp -d <approved mail server> --dport 25 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m tcp --dport 25 -j DROP
iptables- A FORWARD -o eth0 -p tcp -m tcp --dport 445 -j DROP
iptables -A OUTPUT -o eth0 -p tcp -m tcp --dport 445 -j DROP
iptables- A FORWARD -o eth0 -p udp -m udp --dport 445 -j DROP
iptables -A OUTPUT -o eth0 -p udp -m udp --dport 445 -j DROP

Now if I take the tunnel and bridge are down(Only having eth1 NAT'D to eth0), everything works fine. I've read that iptables works at layer 3 and will not filter bridged interfaces. Well tap0 and eth1 are the bridged interfaces, not eth0. So why isn't the firewall stopping these packets? I can telnet to port 25 all day long on non-approved mail servers. 


Anthony R. Vallario

[-- Attachment #2: Type: text/html, Size: 3054 bytes --]