iptables and 802.1q tagging

iptables and 802.1q tagging

[Paul Albert]

Hi - 

I'm using a box with 2 network interfaces as a 
bridge with iptables.  I was attempting to send
packets
that were 802.1Q tagged to the QUEUE target and didn't

see them as expected.  After checking out my 
configuration, it seemed that everything was working
as 
expected (I fully expected something to be incorrect).

I googled to determine whether an iptables 
bridge that is filtering on IP addresses would be 
smart enough to pick up on the fact that the packets 
have 802.1Q tags or not.  No definitive answer was 
found.  My question is just that - does iptables 
notice that the tag is present or will it not know 
what to do with such a packet?

Thanks,
Paul



__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com

iptables and 802.1q tagging

[Paul Albert]

Hi - 

I'm using a box with 2 network interfaces as a bridge with iptables.  I
was attempting to send packets that were 802.1Q tagged to the QUEUE
target and didn't see them as expected.  After checking out my
configuration, it seemed that everything was working as expected (I
fully expected something to be incorrect).

I googled to determine whether an iptables bridge that is filtering on
IP addresses would be smart enough to pick up on the fact that the
packets have 802.1Q tags or not.  No definitive answer was found.  My
question is just that - does iptables notice that the tag is present or
will it not know what to do with such a packet?

Thanks,
Paul

Re: iptables and 802.1q tagging

[Cedric Blancher]

Le mar 27/05/2003 à 19:22, Paul Albert a écrit :
> I googled to determine whether an iptables bridge that is filtering on
> IP addresses would be smart enough to pick up on the fact that the
> packets have 802.1Q tags or not.  No definitive answer was found.  My
> question is just that - does iptables notice that the tag is present or
> will it not know what to do with such a packet?

iptables configures IP layer (OSI 3) and dot1q is layer 2 concept. Thus,
iptables cannot match dot1q extensions.

Nevertheless, you can use ebtables that provides layer 2 filtering on
birdged interfaces and has dot1q matching (vlan match). Using ebtables
you can filter dot1q frames from classicla ones, even match VLAN id,
prio and encapsulated proto.

See http://ebtables.sourceforge.net/

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

RE: iptables and 802.1q tagging

[Paul Albert]

Cedric - 

Thanks for the info.  Now that you mention the layer 3 vs. layer 2
aspects, it makes sense.  It appears that I have some reading to do ...

Paul

-----Original Message-----
From: Cedric Blancher [mailto:blancher@cartel-securite.fr] 
Sent: Tuesday, May 27, 2003 11:38 AM
To: Paul Albert
Cc: netfilter@lists.netfilter.org
Subject: Re: iptables and 802.1q tagging


Le mar 27/05/2003 à 19:22, Paul Albert a écrit :
> I googled to determine whether an iptables bridge that is filtering on

> IP addresses would be smart enough to pick up on the fact that the 
> packets have 802.1Q tags or not.  No definitive answer was found.  My 
> question is just that - does iptables notice that the tag is present 
> or will it not know what to do with such a packet?

iptables configures IP layer (OSI 3) and dot1q is layer 2 concept. Thus,
iptables cannot match dot1q extensions.

Nevertheless, you can use ebtables that provides layer 2 filtering on
birdged interfaces and has dot1q matching (vlan match). Using ebtables
you can filter dot1q frames from classicla ones, even match VLAN id,
prio and encapsulated proto.

See http://ebtables.sourceforge.net/

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

Re: iptables and 802.1q tagging

[Cedric Blancher]

Le mer 21/05/2003 à 02:08, Paul Albert a écrit :
> I googled to determine whether an iptables 
> bridge that is filtering on IP addresses would be 
> smart enough to pick up on the fact that the packets 
> have 802.1Q tags or not.  No definitive answer was 
> found.  My question is just that - does iptables 
> notice that the tag is present or will it not know 
> what to do with such a packet?

I would say no, but not 100% sure of this, for Netfilter as no
particular knowledge about layer 2 (except for mac match). You should
have a look to ebtables :

	http://ebtables.sourceforge.net/

ebtables is a layer 2 filtering tool for Linux bridges, that act as a
Netfilter complement. In particular, it can filter 802.1q frames as such
and match VLAN ID or Prio. From ebtables man :

   vlan
	Specify  802.1Q Tag Control Information fields. The protocol
	must be specified as 802_1Q (0x8100).
                                                                
	--vlan-id [!] id
		The VLAN identifier field (VID). Decimal number from 0
		to 4095.

	--vlan-prio [!] prio
		The  user_priority field. Decimal number from 0 to 7.
		The VID should be set to 0 ("null VID") or unspecified
		(for this case the VID is deliberately set to 0).
 
	--vlan-encap [!] type
		The encapsulated Ethernet frame type/length. Specified
		as hexadecimal number from 0x0000 to 0xFFFF or as a
		symbolic name from /etc/ethertypes.

See ebtables-user@lists.sourceforge.net list if needed.

-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE