On 11/12/08 07:57, Leonardo Rodrigues Magalhães wrote:
i cannot use normal iptables -j ULOG rules, because there's no IP
traffic flowing on the box. Traffic flowing are ethernet frames on the
bridge.
i have tried ebtables with ulog as well:
ebtables -A FORWARD --ulog -j CONTINUE
and then fprobe-ulog to export packets, configuration with works just
fine with iptables ULOG, but didnt worked with ebtables ulog. Maybe i'm
missing some ebtables rule or different target than ulog ..... this is
the first time i've used ebtables anyway.
Have you considered enabling "Bridged NetFilter" (a.k.a. bridge-nf and
brnf)? That should allow IPTables to see the bridged ethernet frames.
If IPTables can see the frames, you should be able to do what you are
accustom to doing. At least I think.
but .... i got a third idea on how to accomplish that. My idea, with
this box, is to put it right in front the firewall (yes, with proper
authorization, nothing illegal here), so i would have the whole network
in one side of the bridge and the firewall on the other side of the
bridge. In other words ..... several MACs which i dont know which would
be on one side, and just a single MAC, known one, on the other side of
the bridge.
based on this, i tought on doing some arpspoof thing, having this box
to fake arp replies to the firewall MAC address and sending it's own and
then forwarding the frames to the real firewall.
Yuck.
IMHO this is in effect a poor mans form of Proxy ARP(ing), which is a
very poor substitute for bridging.
i dont know how to do this and dont know neither if this setup would
help me acchieving what i need.
I don't think it would.
Either you will be passing ethernet frames with out them passing through
the higher IP stack, or you will be doing routing which will require
modifying your network structure or some (IMHO very nasty) hacks with
policy based routing.
well .... i would like to hear some ideas on how to acchieve my
goals. Can anyone help me on this scenario ?
Take a look at bridged netfilter and see if it will do what you are
wanting to do.
Grant. . . .
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
