bridge/ebtables/iptables interaction question

bridge/ebtables/iptables interaction question

[Sandy C]

Hi,
   I have a Linux box with 2 NICS. One is a standard
one port 10/100 NIC (eth0). The other is a Quad FE.
I'm running a bridge across the Quad FE NIC, so all
ports are enslaved by the bridge.

   I have 2 systems, a client and a server attached to
the Quad NIC (aka the bridge) Network connectivity etc
is fine. The client is on eth1 and the server is on
eth2. The single port (eth0) on the Linux box (lets
call this the middle box) running the bridge is
connected to the bridge through a hub on eth3..I ran
out of crossover cables, else I would've had a
crossover cable from eth0 to the bridge.

   I would like to filter the network traffic flowing
between the client and server, that is going through
the bridge. So on the "middle" box, I have the
following iptables rules:

iptables -A INPUT -m physdev --physdev-in eth1 -p tcp
--destination-port 2049 -j LOG
(The idea here is to log all traffic from the client
to the NFS server)

The other rule says:
iptables -A INPUT -m physdev --physdev-in eth2 -p tcp
--source-port 2049 -j LOG
(Log all traffic from the NFS server to the client)

I must be missing something though because I get
nothing in my logs. I ran ethereal, and it is able to
sniff traffic between the client and the server. So
I'm guessing I've missed something in the iptables
rules...what could I be doing wrong? 

Any suggestions would be much appreciated.
Thanks!
S C


__________________________________
Do you Yahoo!?
Yahoo! Finance Tax Center - File online. File on time.
http://taxes.yahoo.com/filing.html

Re: bridge/ebtables/iptables interaction question

[Cedric Blancher]

Le mar 23/03/2004 à 22:16, Sandy C a écrit :
> iptables -A INPUT -m physdev --physdev-in eth1 -p tcp
> --destination-port 2049 -j LOG
[...]
> iptables -A INPUT -m physdev --physdev-in eth2 -p tcp
> --source-port 2049 -j LOG
[...]
> I must be missing something though because I get
> nothing in my logs.
[...]
> what could I be doing wrong? 

Bridged traffic goes through FORWARD chain, for it's not destined to
your box.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: bridge/ebtables/iptables interaction question

[Sandy C]

That didn't work either. I wonder if its my kernel
version. I'm running:

Kernel: 2.4.20-6
patch: ebtables-brnf-3_vs_2.4.21.diff (applied 3/16)
       Latest POM (12/03: applied 3/22)
IPTables: 1.2.9
EBTables: 2.0.6

From the docs, the br-nf code is required for iptables
to see the bridge traffic. I'm wondering if the order
in which I applied the patches matters. I'll go take a
look at that, but if you folks have any hints I'd much
appreciate it!

Merci beaucoup,
S C

--- Cedric Blancher <blancher@cartel-securite.fr>
wrote:
> Le mar 23/03/2004 à 22:16, Sandy C a écrit :
> > iptables -A INPUT -m physdev --physdev-in eth1 -p
> tcp
> > --destination-port 2049 -j LOG
> [...]
> > iptables -A INPUT -m physdev --physdev-in eth2 -p
> tcp
> > --source-port 2049 -j LOG
> [...]
> > I must be missing something though because I get
> > nothing in my logs.
> [...]
> > what could I be doing wrong? 
> 
> Bridged traffic goes through FORWARD chain, for it's
> not destined to
> your box.
> 
> 
> -- 
> http://www.netexit.com/~sid/
> PGP KeyID: 157E98EE FingerPrint:
> FA62226DA9E72FA8AECAA240008B480E157E98EE
> >> Hi! I'm your friendly neighbourhood signature
> virus.
> >> Copy me to your signature file and help me
> spread!
> 


__________________________________
Do you Yahoo!?
Yahoo! Finance Tax Center - File online. File on time.
http://taxes.yahoo.com/filing.html

RE: bridge/ebtables/iptables interaction question

[Daniel Chemko]

Change your rules to use FORWARD instead of INPUT. Any luck?