victor oliveira wrote:
On 12/3/06, *Martijn Lievaart* <m@xxxxxxx <mailto:m@xxxxxxx>> wrote:
victor oliveira wrote:
> My problem is the following: I am able to connect from my machine to
> the firewall using both eth2 and eth3. However, note that the INPUT
> default is DROP, and the only rule on the INPUT SHOULD be filtering
> and only allowing connections to the eth2 and not the eth3
> interface...
You rules are a bit messy, but it should probably work. Are you
sure you
connect through eth3? You do say it is from the same machine, if
you are
connected to eth2 and address the ip addres of eth3, you still
come in
through eth2.
eth2 and eth3 are both connected to the same switch, and are not
virtual. Each with a different IP.
eth2 has the IP 10.10.1.8 <http://10.10.1.8> and eth3 has the ip
10.10.1.9 <http://10.10.1.9>.
I´m using for testing a putty application from another machine, also
connected to the same switch.
I know it should be working but it is not.
Furthermore, I tested the mangle rules for multiple tables and it only
works without the -i option.
My "solution" was to change to different subdomains and just not use
the -i restriction...
any thoughts ?
[ Please don't toppost]
Aha, but linux answers arp requests on any interface. So in this setup,
an arp request for the address of eth3 can very well be answered by
eth2. In fact it probably was, given your results. Try to turn of
proxy_arp on the firewall or disconnect eth2 for the test. You'll
probably see very different results then.
HTH
M4
