Bridging firewall with iptables

Bridging firewall with iptables

[Pete Davis]

I have been trying to get a bridging firewall setup with iptables.  The
iptables part, by itself, is not an issue.  I can get it done.  My
question is: has anyone here ever gotten the bridging + iptables
firewall to work?

I am using 2.4.19 (I never get anything but 2.4.19 with dmesg or uname
-a) with bridge-nf-0.0.7-against-2.4.19.diff for the bridging patch.  I
am following the documentation provided on bridge.sourceforge.org.

I d/l'ed the 2.4.19.  Patched with bridge patch above.  Made the kernel
with iptables support (most options as modules), "8021.d Ethernet
bridging" and "netfilter (firewalling) support" included.  Everything
compiled and installed without errors.  I added the interfaces to the
bridge interface per the directions.  Set all ip addresses to 0.0.0.0
promisc per the directions in the documentation.  The default rules for
iptables are allow for input, output and forward (forward is the only
one of importance).

At this point, I cannot get any devices on the 'outside' of the
firewall to reach anything 'inside' the firewall.  Since all the rules
are accept, it should work.  I get the feeling the problem may be with
the bridging portion.

Anyone gotten this bridge + firewall to work?

Thanks,
Pete

Re: Bridging firewall with iptables

[mourik jan c heupink]

did you get any responses already...?

i'm not much i a guru myself, but i have gotten this to work, and it
works beautifully here...

maybe i can be of assistance..?

outside to inside doesn't work, you say. the other way does? inside to
outside..?

mj

On Mon, 2002-10-07 at 22:42, Pete Davis wrote:
> I have been trying to get a bridging firewall setup with iptables.  The
> iptables part, by itself, is not an issue.  I can get it done.  My
> question is: has anyone here ever gotten the bridging + iptables
> firewall to work?
> 
> I am using 2.4.19 (I never get anything but 2.4.19 with dmesg or uname
> -a) with bridge-nf-0.0.7-against-2.4.19.diff for the bridging patch.  I
> am following the documentation provided on bridge.sourceforge.org.
> 
> I d/l'ed the 2.4.19.  Patched with bridge patch above.  Made the kernel
> with iptables support (most options as modules), "8021.d Ethernet
> bridging" and "netfilter (firewalling) support" included.  Everything
> compiled and installed without errors.  I added the interfaces to the
> bridge interface per the directions.  Set all ip addresses to 0.0.0.0
> promisc per the directions in the documentation.  The default rules for
> iptables are allow for input, output and forward (forward is the only
> one of importance).
> 
> At this point, I cannot get any devices on the 'outside' of the
> firewall to reach anything 'inside' the firewall.  Since all the rules
> are accept, it should work.  I get the feeling the problem may be with
> the bridging portion.
> 
> Anyone gotten this bridge + firewall to work?
> 
> Thanks,
> Pete

bridging firewall with Iptables

[Afshin Lamei]

Hi,
I want to do both bridging and firewalling with linux. I've some questions 
about it:
1 - When I start up bridging, I see that all my linux terminals are 
outputing the bridge trafic and I am not able to see my command prompt! so 
how can I prevent it from doing so?
2 - Can I use all of the benefits of Iptables in a bridging firewall?
thanks,
afshin





_________________________________________________________________
The new MSN 8: smart spam protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail

Re: bridging firewall with Iptables

[Cedric Blancher]

Le mar 04/02/2003 à 12:00, Afshin Lamei a écrit :
> 2 - Can I use all of the benefits of Iptables in a bridging firewall?

See http://ebtables.sourceforge.net/

br_nf patch allows bridged frames to be visible into Netfilter
framework. So one can filter them. That's imho what you want.

ebtables_kernel patch allows more L2 filtering at bridge level, using
ebtables userlan utility.

Use them together.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE