Re: Confused about bridging, firewall (iptables), and DHCP

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Tony Nelson wrote:
> At 3:16 PM +1030 3/14/07, Tim wrote:
>> On Tue, 2007-03-13 at 22:28 -0400, Tony Nelson wrote:
>>> I'm reading Rusty Russell's Linux iptables HOWTO now.  Section 5 says
>>> it works on IPs, not on interfaces.
>> You can make rules that refer to interfaces.  They're useful when you
>> want to simply trust/distrust anything on it, or the addresses for it
>> are changeable.
>>
>> A rule for any incoming ethernet interface:
>> iptables --append INPUT --jump DROP --protocol tcp --in-interface eth+
>>
>> A rule for any incoming eth1 interface:
>> iptables --append INPUT --jump DROP --protocol tcp--in-interface eth1
> 
> Note that these rules affect only packets addressed to an IP of this box,
> and won't affect packets to other IPs, which will use the FORWARD chain,
> according to Rusty's iptables HOWTO and my experiments.  Traffic from my
> box's IP to the VM's IP goes through the OUTPUT chain (which by default has
> no rules), and traffic the other way goes through the INPUT chain.  IIUC,
> traffic from the world to the VM's IP should go through the FORWARD chain
> either way, and doesn't use the INPUT or OUTPUT chains, and the counter I
> put on FORWARD seems to agree.
> 
>     /sbin/iptables -F FORWARD
>     /sbin/iptables -A FORWARD -j ACCEPT

Unless this bridge is set up different then what is described in the
 bridge-utils documentation, you should not need any forwarding
rules between eth0 and tap0. By creating the bridge, you are tying
the two interfaces together. Running "ifconfig br0
my.ip.address.here" is supposed to take care it. From the
bridge-utils HOWTO:

        # ifconfig eth0 0.0.0.0
        # ifconfig eth1 0.0.0.0
        # ifconfig br0 my.ip.address.here

The last command also puts the interface br0 into the 'up' state.
This will activate the forwarding of packets, which in plain English
means that from that point on, eth0 and eth1 will be 'joined'
together. Hosts on eth0 should 'see' hosts on eth1 and vice versa.

But my experience with bridging is limited to Debian on a Stylistic
1000...

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora Magazine]     [Fedora News]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [SSH]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux