Re: -i interface filter not working for firewall

[Martijn Lievaart <m@rtij.nl>]

victor oliveira wrote:

>
> On 12/3/06, *Martijn Lievaart* <m@rtij.nl <mailto:m@rtij.nl>> wrote:
>
>     victor oliveira wrote:
>
>     > My problem is the following: I am able to connect from my machine to
>     > the firewall using both eth2 and eth3. However, note that the INPUT
>     > default is DROP, and the only rule on the INPUT SHOULD be filtering
>     > and only allowing connections to the eth2 and not the eth3
>     > interface...
>
>
>     You rules are a bit messy, but it should probably work. Are you
>     sure you
>     connect through eth3? You do say it is from the same machine, if
>     you are
>     connected to eth2 and address the ip addres of eth3, you still
>     come in
>     through eth2.
>
> eth2 and eth3 are both connected to the same switch, and are not
> virtual. Each with a different IP.
> eth2 has the IP 10.10.1.8 <http://10.10.1.8> and eth3 has the ip
> 10.10.1.9 <http://10.10.1.9>.
> I´m using for testing a putty application from another machine, also
> connected to the same switch.
> I know it should be working but it is not.
> Furthermore, I tested the mangle rules for multiple tables and it only
> works without the -i option.
> My "solution" was to change to different subdomains and just not use
> the -i restriction...
> any thoughts ?
>


[ Please don't toppost]

Aha, but linux answers arp requests on any interface. So in this setup,
an arp request for the address of eth3 can very well be answered by
eth2. In fact it probably was, given your results. Try to turn of
proxy_arp on the firewall or disconnect eth2 for the test. You'll
probably see very different results then.

HTH
M4