Hello Guys,
i'm trying to setup a box and i'd like to present my ideas and,
luckly, got some as well :)
im setting up a small linux box with 2 NICs working as a bridge.
That's OK, no problem on that. Maybe the interesting point is that it's
a Routerboard 450 with OpenWRT, so i dont have the same flexibility of a
full linux box. But the bridge part is working just fine, i have frames
flowing through interfaces.
So, at the exact moment, i can use this box to monitor some network
segment and see, on the box, tcpdump for example, everything that passes
from one ethernet to another with no logical changes to the network. No
need of IP changing, no need on routing changing. Of course it has an ip
address, but that's just for management.
next step would be, with this box, export netflow traffic so i could
analyse it better on any netflow collector/analyzer software, which
would give me a MUUUCH better network analyzis than simple iptraf that
i'm actually using.
the problems .....
i cannot use normal iptables -j ULOG rules, because there's no IP
traffic flowing on the box. Traffic flowing are ethernet frames on the
bridge.
i have tried ebtables with ulog as well:
ebtables -A FORWARD --ulog -j CONTINUE
and then fprobe-ulog to export packets, configuration with works
just fine with iptables ULOG, but didnt worked with ebtables ulog. Maybe
i'm missing some ebtables rule or different target than ulog ..... this
is the first time i've used ebtables anyway.
but .... i got a third idea on how to accomplish that. My idea, with
this box, is to put it right in front the firewall (yes, with proper
authorization, nothing illegal here), so i would have the whole network
in one side of the bridge and the firewall on the other side of the
bridge. In other words ..... several MACs which i dont know which would
be on one side, and just a single MAC, known one, on the other side of
the bridge.
based on this, i tought on doing some arpspoof thing, having this
box to fake arp replies to the firewall MAC address and sending it's own
and then forwarding the frames to the real firewall.
i dont know how to do this and dont know neither if this setup would
help me acchieving what i need.
well .... i would like to hear some ideas on how to acchieve my
goals. Can anyone help me on this scenario ?
--
Atenciosamente / Sincerily,
Leonardo Rodrigues
Solutti Tecnologia
http://www.solutti.com.br
Minha armadilha de SPAM, NÃO mandem email
gertrudes@xxxxxxxxxxxxxx
My SPAMTRAP, do not email it
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
