Re: Filtering PPP traffic

[Francis GASCHET <fg@numlog.fr>]

Yes, but netfilter looks ignoring these packets.

I sniffed them using ethereal. But I've to set manually the "interface" 
to nas0. Ethereal doesn't show it in its list. May be something not 
standard or missing in the eth emulation of this kind of device...
But if I enter "nas0" manually in the "interface" ethereal is able to 
record the data and decodes it.

I think I missed something in iptables working.
I begin to feel that the packets flowing through nas0 disturb iptables 
because they have a 6+2 bytes pppOE header between Ethernet header and 
IP header...
May be a hack is needed in netfilter / iptables...

Any clue ?

F. GASCHET



SBlaze wrote:

>Have you tried filtering on the nas0 device?
>
>--- Francis GASCHET <fg@numlog.fr> wrote:
>  
>
>>Hello,
>>
>>The bridge we use is the kernel patch provided by 
>>http://bridge.sourceforge.net
>>On the card side, we use Ethernet over ATM bridging (RFC 1483/2684 
>>kernel module). It emulates an "Ethernet like" device : nas0.
>>The pppOE daemon sits in the VM where it reads and writes ppp frames on 
>>a virtual eth device created with TAP (http://Vtun.sourceforge.net).
>>The official address is carried by this virtual eth device.
>>The bridge forwards pppOE packets between the nas0 and the tap0 devices.
>>The goal is to use a bridged firewall. That means : a FireWall which is 
>>not visible from the external network.
>>
>>The problem is to be able to filter the pppOE packets that flow across 
>>the bridge.
>>    
>>