Re: PPPoE on a bridge, nat sees bridge as incoming interface

[Georgi Georgiev <chutz@gg3.net>]

maillog: 06/03/2008-16:01:35(-0600): Grant Taylor types
> On 3/6/2008 11:22 AM, Georgi Georgiev wrote:
>> I am having trouble understaning how bridging and iptables fit together. 
>> The situation that bugs me is: if I do a PPPoE connection over a bridge 
>> with a single physical port, my nat table will see any incoming packet as 
>> coming from the bridge interface, and not the ppp interface. Why?
>
> With out going any further in your email (I've read the rest but IMHO this 
> takes precedence).  Is your kernel configured to have IPTables see your 
> bridged traffic?  Is "CONFIG_BRIDGE_NETFILTER" enabled in your kernel?  
> Here is a quote from help from menuconfig about Bridge Netfilter:
>
> "Enabling this option will let arptables resp. iptables see bridged ARP 
> resp. IP traffic. If you want a bridging firewall, you probably want this 
> option enabled.  Enabling or disabling this option doesn't enable or 
> disable ebtables."
>
> If you turn this off your bridging will be a purely layer 2 operation that 
> IPTables (and ARPTables) will be completely oblivious of.  If you wish to 
> filter bridged traffic you will have to use EBTables. Incidentally I have 
> had better luck turning this off (unless I had to have IPTables filtering 
> of bridged traffic) and using EBTables to filter bridged traffic.  I 
> consider this to be use layer 3 filtering (IPTables and ARPTables) for 
> layer 3 traffic and use layer 2 filtering (EBTables) for layer 2 traffic.  
> In other words don't use layer 3 filtering for layer 3 and 2 traffic which 
> is what this does.  Granted you can use IPTables to filter layer 2 traffic, 
> however you have to be aware of the ramifications and account for them in 
> your firewall and logic in your head.

I agree. I thought the bridge was supposed to behave like a switching
hub. And it probably does, but I had misconfigured it.

I have applided the sysctl fix from the other post in the thread for
now. I'll test your suggestion when I get home.

-- 
(    Georgi Georgiev   (  Q: Why did the lone ranger kill Tonto? A:  (
 )    chutz@gg3.net     ) He found out what "kimosabe" really means.  )
(  http://www.gg3.net/ (                                             (