* Re: I can't vpn ! - ebtables can forward GRE?
[not found] <200205291810.53634.jorge@kernel-panik.org>
@ 2002-05-30 3:21 ` Bart De Schuymer
0 siblings, 0 replies; only message in thread
From: Bart De Schuymer @ 2002-05-30 3:21 UTC (permalink / raw)
To: Jorge# ./S, bridge; +Cc: Antony, netfilter
On Thursday 30 May 2002 00:10, Jorge# ./S wrote:
> Any ebtables expert can help us solve this:
>
> Can GRE packets be forwarded on a linux box using ebtables?
>
> ---------- Forwarded Message ----------
>
> Subject: Re: I can't vpn ! - ebtables can forward GRE?
> Date: Thu, 30 May 2002 00:09:11 +0100
> From: Antony Stone <Antony@Soft-Solutions.co.uk>
> To: netfilter@lists.samba.org
>
> On Wednesday 29 May 2002 11:00 pm, Jorge Sarmiento wrote:
> > With ebtables you can block protocols that are not TCP, and let pass TCP,
> > ICMP and UDP to your network... you can also redirect TCP packets to do
> > an "invisible transparent proxy", mixing bridging and ebtables... then
> > why couldn't GRE packets be forwarded??
If you know the protocol number of these GRE packets you can filter on the
protocol number. ebtables -p IPv4 --ip-protocol 47. There is only support for
ip header filtering. E.g. no TCP port filtering, certainly no GRE specific
filtering. These things belong in iptables.
With ebtables you can only change the MAC source and destination address. A
redirect in ebtables only means the MAC destination of the frame is changed
to that of the bridge, causing the frame to be routed or delivered to the
bridge itself. You can also make a brouter with ebtables. IP redirects
obviously belong in iptables.
I'm not subscribed to the netfilter users list. For ebtables questions there
is a mailing list too. See the ebtables hp.
cheers,
Bart
^ permalink raw reply [flat|nested] only message in thread