Re: FORWARD chain and Interfaces

[netfilter@buglecreek.com]

On Sun, 22 May 2011 00:05 +0200, "Pascal Hambourg"
<pascal.mail@plouf.fr.eu.org> wrote:
> netfilter@buglecreek.com a écrit :
> > On Sat, 21 May 2011 22:51 +0200, "Pascal Hambourg"
> >>
> >> How are the virtual machine network interfaces connected together ?
> >> Did you create two separate virtual links ?
> >> One explanation could be that all interfaces are connected to the same
> >> virtual link, so traffic coming to the router could arrive at any of its
> >> two interfaces.
> > 
> > That's an interesting idea.  I'm not sure how Parallels sets up the
> > interfaces.
> 
> How then do you know which interface of the router is connected to which
> network ?

I'm basing the router connections to the various networks by the IP
addresses and network Addresses.  When I say I don't know how Parallels
sets up the interfaces I mean I do not know the underling code that they
use.  Using standard tools (ifconfig, route, traceroute etc) all seems
normal.

Sending a broadcast packet (good idea) from network B I see the packet
show up at network A machine and on both interfaces of the firewall.  I
even see the packets show up on network A when the firewall/router is
turned off.  Both Net A and Net B are assigned IPs on two entirely
different networks.  Obviously, this is not the expected behavior.  I
assumed that when I created two virtual machines and assigned them
entirely different IPs on different networks they would be isolated from
each other and not be able to see traffic (broadcasts etc) from the
other net.   I will have to look at how the virtual machines are setup,
maybe there is something I missed.  It clearly does not function as I
expected.  My hope was to simulate real life different nets connected by
the firewall/router.  

> 
> A quick test could be to send broadcast packets from A then B while
> listening on all interfaces of the other machines with tcpdump or the
> like. If you can see the broadcast packets on all interfaces then they
> all are on the same network.
> 
> > Right now I'm writing the FORWARD rules assuming that when the real
> > hardware is in place it will function as I expect.  I'm using -i eth0
> > and -o eth1 for new traffic originating from Network A going to B  and
> > -i eth1 and -o eth0 for new traffic originating from Network B to A.  
> > Based on my original diagram below.  Does that sound reasonable?
> 
> Sure.
>