Filtering PPP traffic

Filtering PPP traffic

[Francis GASCHET]

Hi list,

Is there somebody who knows a possibility to apply netfilter rules to 
ppp packets ?

Configuration :

DSL - PCI modem card - BRIDGE - eth0 (in a virtual machine)

I would like to filter the traffic which flows across the bridge, but at 
this level, the IP traffic is encapsulated...

Any clue ?

Ciao.

-- 
Francis GASCHET / NUMLOG
http://www.numlog.fr
Tel.: +33 (0) 130 791 616
Fax.: +33 (0) 130 819 286

Re: Filtering PPP traffic

[SBlaze]

You should be able to filter at the "eth0" level of your diagram...

I kinda need more information on your "BRIDGE" before I could suggest something
else.. If by bridge you mean it bridges the DSL modem and the LAN...then your
eth0 is in the same machine you are calling a bridge?

In that case you should theoretically filter the eth0 device


--- Francis GASCHET <fg@numlog.fr> wrote:
> Hi list,
> 
> Is there somebody who knows a possibility to apply netfilter rules to 
> ppp packets ?
> 
> Configuration :
> 
> DSL - PCI modem card - BRIDGE - eth0 (in a virtual machine)
> 
> I would like to filter the traffic which flows across the bridge, but at 
> this level, the IP traffic is encapsulated...
> 
> Any clue ?
> 
> Ciao.
> 
> -- 
> Francis GASCHET / NUMLOG
> http://www.numlog.fr
> Tel.: +33 (0) 130 791 616
> Fax.: +33 (0) 130 819 286
> 
> 
> 
> 
> 


=====
"No touchy NO TOUCHY! Emperor Kuzko -=Emperor's New Groove=-"

__________________________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo
http://search.yahoo.com

Re: Filtering PPP traffic

[Francis GASCHET]

Hello,

The bridge we use is the kernel patch provided by 
http://bridge.sourceforge.net
On the card side, we use Ethernet over ATM bridging (RFC 1483/2684 
kernel module). It emulates an "Ethernet like" device : nas0.
The pppOE daemon sits in the VM where it reads and writes ppp frames on 
a virtual eth device created with TAP (http://Vtun.sourceforge.net).
The official address is carried by this virtual eth device.
The bridge forwards pppOE packets between the nas0 and the tap0 devices.
The goal is to use a bridged firewall. That means : a FireWall which is 
not visible from the external network.

The problem is to be able to filter the pppOE packets that flow across 
the bridge.

-- 
Francis GASCHET / NUMLOG
http://www.numlog.fr
Tel.: +33 (0) 130 791 616
Fax.: +33 (0) 130 819 286




Thanks for any help.

SBlaze wrote:

>You should be able to filter at the "eth0" level of your diagram...
>
>I kinda need more information on your "BRIDGE" before I could suggest something
>else.. If by bridge you mean it bridges the DSL modem and the LAN...then your
>eth0 is in the same machine you are calling a bridge?
>
>In that case you should theoretically filter the eth0 device
>
>
>--- Francis GASCHET <fg@numlog.fr> wrote:
>  
>
>>Hi list,
>>
>>Is there somebody who knows a possibility to apply netfilter rules to 
>>ppp packets ?
>>
>>Configuration :
>>
>>DSL - PCI modem card - BRIDGE - eth0 (in a virtual machine)
>>
>>I would like to filter the traffic which flows across the bridge, but at 
>>this level, the IP traffic is encapsulated...
>>
>>Any clue ?
>>
>>Ciao.
>>
>>    
>>

Re: Filtering PPP traffic

[SBlaze]

Have you tried filtering on the nas0 device?

--- Francis GASCHET <fg@numlog.fr> wrote:
> 
> Hello,
> 
> The bridge we use is the kernel patch provided by 
> http://bridge.sourceforge.net
> On the card side, we use Ethernet over ATM bridging (RFC 1483/2684 
> kernel module). It emulates an "Ethernet like" device : nas0.
> The pppOE daemon sits in the VM where it reads and writes ppp frames on 
> a virtual eth device created with TAP (http://Vtun.sourceforge.net).
> The official address is carried by this virtual eth device.
> The bridge forwards pppOE packets between the nas0 and the tap0 devices.
> The goal is to use a bridged firewall. That means : a FireWall which is 
> not visible from the external network.
> 
> The problem is to be able to filter the pppOE packets that flow across 
> the bridge.
> 
> -- 
> Francis GASCHET / NUMLOG
> http://www.numlog.fr
> Tel.: +33 (0) 130 791 616
> Fax.: +33 (0) 130 819 286
> 
> 
> 
> 
> Thanks for any help.
> 
> SBlaze wrote:
> 
> >You should be able to filter at the "eth0" level of your diagram...
> >
> >I kinda need more information on your "BRIDGE" before I could suggest
> something
> >else.. If by bridge you mean it bridges the DSL modem and the LAN...then
> your
> >eth0 is in the same machine you are calling a bridge?
> >
> >In that case you should theoretically filter the eth0 device
> >
> >
> >--- Francis GASCHET <fg@numlog.fr> wrote:
> >  
> >
> >>Hi list,
> >>
> >>Is there somebody who knows a possibility to apply netfilter rules to 
> >>ppp packets ?
> >>
> >>Configuration :
> >>
> >>DSL - PCI modem card - BRIDGE - eth0 (in a virtual machine)
> >>
> >>I would like to filter the traffic which flows across the bridge, but at 
> >>this level, the IP traffic is encapsulated...
> >>
> >>Any clue ?
> >>
> >>Ciao.
> >>
> >>    
> >>
> 
> 
> 
> 


=====
"No touchy NO TOUCHY! Emperor Kuzko -=Emperor's New Groove=-"

__________________________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo
http://search.yahoo.com

Re: Filtering PPP traffic

[Francis GASCHET]

Yes, but netfilter looks ignoring these packets.

I sniffed them using ethereal. But I've to set manually the "interface" 
to nas0. Ethereal doesn't show it in its list. May be something not 
standard or missing in the eth emulation of this kind of device...
But if I enter "nas0" manually in the "interface" ethereal is able to 
record the data and decodes it.

I think I missed something in iptables working.
I begin to feel that the packets flowing through nas0 disturb iptables 
because they have a 6+2 bytes pppOE header between Ethernet header and 
IP header...
May be a hack is needed in netfilter / iptables...

Any clue ?

F. GASCHET



SBlaze wrote:

>Have you tried filtering on the nas0 device?
>
>--- Francis GASCHET <fg@numlog.fr> wrote:
>  
>
>>Hello,
>>
>>The bridge we use is the kernel patch provided by 
>>http://bridge.sourceforge.net
>>On the card side, we use Ethernet over ATM bridging (RFC 1483/2684 
>>kernel module). It emulates an "Ethernet like" device : nas0.
>>The pppOE daemon sits in the VM where it reads and writes ppp frames on 
>>a virtual eth device created with TAP (http://Vtun.sourceforge.net).
>>The official address is carried by this virtual eth device.
>>The bridge forwards pppOE packets between the nas0 and the tap0 devices.
>>The goal is to use a bridged firewall. That means : a FireWall which is 
>>not visible from the external network.
>>
>>The problem is to be able to filter the pppOE packets that flow across 
>>the bridge.
>>    
>>