From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Steve Jones" Subject: RE: iptables bridge filter question Date: Thu, 18 Mar 2004 10:02:46 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <79C037414A4B604CA73F5222570C6DFC800F@e2k3.ftdata.com> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C40CFA.12CC48E1" Return-path: Content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Gerry Weaver , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------_=_NextPart_001_01C40CFA.12CC48E1 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I don't think I'm entirely clear about what you are trying to block, but I *THINK* I just went through the learning curve to do a similar thing myself, and was successful. Check out ebtables.sourceforge.net. My requirement was to put a transparent bridge between a router and a switch, to block or allow CERTAIN traffic based on source and/or destination IP addresses. My particular scenario would have been more appropriately handled by standard iptables, except for that I don't control the network configuration, so I couldn't change any IP addresses. =20 Basically, I downloaded the latest ebtables user space utilities, and the kernel source for 2.6.4, compiled it on my fresh RH9 box, then compiled the ebtables tools. Ebtables then gave me the ability to filter packets at layer two, while bridging. I'm not at the site today where the firewall is, but I'm going to be VPNing in later to get the small scripts I used. Let me know if you want me to send them as an example. =20 -Steve =20 ________________________________ From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Gerry Weaver Sent: Thursday, March 18, 2004 3:28 AM To: netfilter@lists.netfilter.org Subject: iptables bridge filter question =20 Hello All, =20 I have setup a bridging firewall. I want to drop packets on the external interface, which have source addresses on my internal network. However, the firewall/bridge sits between my T1 router and the rest of my LAN. Is there a way to drop the packets mentioned previously, but allow the router? I guess a rule could be created that uses the routers mac address as a match. I've been playing around with this, but I'm not getting the result I want. I could sure use some advice on this. =20 [ LAN xx.xx.xx.0/24 ]<=3D=3D>[ bridge/firewall ]<=3D=3D>[ router = xx.xx.xx.254/24 ] =20 =20 Thanks in advance, Gerry ------_=_NextPart_001_01C40CFA.12CC48E1 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I don’t think I’m = entirely clear about what you are trying to block, but I *THINK* I just went through the learning curve to do a = similar thing myself, and was successful.  = Check out ebtables.sourceforge.net.  = My requirement was to put a transparent bridge between a router and a = switch, to block or allow CERTAIN traffic based on source and/or destination IP = addresses.  My particular scenario would = have been more appropriately handled by standard iptables, except for that I = don’t control the network configuration, so I couldn’t change any IP = addresses.

 

Basically, I downloaded the latest ebtables user space utilities, and the kernel source for 2.6.4, compiled = it on my fresh RH9 box, then compiled the ebtables tools.  Ebtables then gave = me the ability to filter packets at layer two, while = bridging.


I’m not at the site today where the firewall is, but I’m = going to be VPNing in later to get the small scripts I used.  Let me know if you want me to = send them as an example.

 

-Steve

 

From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Gerry Weaver
Sent: Thursday, March 18, = 2004 3:28 AM
To: = netfilter@lists.netfilter.org
Subject: iptables bridge = filter question

 

Hello All,

 

I have setup a bridging firewall. I want to drop = packets on the external interface, which have source addresses on my internal = network. However, the firewall/bridge sits between my T1 router and the rest of = my LAN. Is there a way to drop the packets mentioned previously, but allow the = router? I guess a rule could be created that uses the routers mac address as a = match. I've been playing around with this, but I'm not getting the result I = want. I could sure use some advice on this.

 

[ LAN xx.xx.xx.0/24 ]<=3D=3D>[ bridge/firewall ]<=3D=3D>[ router xx.xx.xx.254/24 ]

 

 

Thanks in advance,

Gerry

------_=_NextPart_001_01C40CFA.12CC48E1--