Re: SYNPROXY module with bridge

Re: SYNPROXY module with bridge

[Todor Todorov]

Hello,

I was check and as you said REJECT target also doesn't work in Bridge.
Where is the problem - in "br.c" or it must add a check in 
"ipt_synproxy.c" for is the packet coming from bridged interface?
I find this patch for reject in bridge but doesn't work - 
http://markmail.org/message/zkd57gfh7htcbyvc#query:+page:1+mid:spwhgpx2jl6iholn+state:results

Any help would be useful to me...

Thank you!

----------------------------
Kind regards,
Todor Todorov
System Administrator
4 Vendeta LTD
GSM: +359 895 935 835
root@4vendeta.com
----------------------------

На 05.4.2015 г. в 14:47, Patrick McHardy написа:
> On 04.04, Todor Todorov wrote:
>> Hello,
>>
>>  From 1 week ago I'm trying to patch synproxy module to work in bridge mode.
>> The problem is that SYNPROXY is not send syn-ack by bridge, its send by
>> default route.
>> I know roughly C language but failed to rewrite and work..
>>
>> This is the topology of the problem:
>>
>> User -----> SYN ------> Firewall - br0 - physdev vlan10
>> Firewall - eth0? -------> SYN-ACK ------> User
>>
>> Should be like:
>>
>> Firewall - br0 - physdev vlan10 -------> SYN-ACK ------> User
>>
>> Please help or some guidance on how to fix this problem.
> You should have a look at the REJECT target, which faces the same problem.
> Also please CC the netfilter-devel list on questions like that, someone
> might jump in to help.