Hello, Eddie a écrit : [...] > # Drop everything and build up Input and Output to accept IP and ARP > ebtables -P FORWARD DROP > ebtables -P INPUT DROP > ebtables -P OUTPUT DROP > ebtables -A INPUT -p IPv4 -j ACCEPT > ebtables -A INPUT -p ARP -j ACCEPT > ebtables -A INPUT --log-level info --log-ip --log-prefix EBFW > ebtables -A OUTPUT -p IPv4 -j ACCEPT > ebtables -A OUTPUT -p ARP -j ACCEPT > ebtables -A OUTPUT --log-level info --log-ip --log-arp --log-prefix EBFW > -j DROP Why log IP and ARP info after accepting IP and ARP packets ? Obviously, only non-(IP or ARP) packets would reach the log rules, so there is no IP or ARP information to log. > #drop DHCP broadcast > ebtables -A FORWARD -d ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff -p IPv4 > --ip-prot udp --ip-dport 67:68 --log-level info --log-ip --log-prefix > EBFWbc -j DROP What is this rule for ? The second rule below already matches all DHCP traffic. > ebtables -A FORWARD -p ipv4 --ip-proto tcp --ip-destination-port 67:68 > --log-level info --log-ip --log-prefix EBFWtcp -j DROP What is this rule for ? DHCP uses only UDP, not TCP. > ebtables -A FORWARD -p ipv4 --ip-proto udp --ip-destination-port 67:68 > --log-level info --log-ip --log-prefix EBFWudp -j DROP [...] > Sep 12 19:05:09 firewall kernel: EBFWbc IN=tap0 OUT=eth1 MAC source = > 00:10:dc:e3:2e:64 MAC dest = ff:ff:ff:ff:ff:ff proto = 0x0800 IP > SRC=192.168.8.22 IP DST=255.255.255.255, IP tos=0x00, IP proto=17 SPT=68 > DPT=67 > Sep 12 19:05:09 firewall dhcpd: DHCPINFORM from 192.168.8.22 via br0 [...] > ebtables seems to want to block the packets, but dhcpd gets them anyway > and responds. Note that on both sides of the connection have dhcpd > running on br0, on with different ranges. (both eth1 and tap0 are > bridged to br0) As in iptables, the FORWARD chain sees only bridged packets. Packets received by the local host go through the INPUT chain, and locally-generated packets go through the OUTPUT table. The broadcast DHCP request is both bridged through the FORWARD chain and received locally through the INPUT chain. Your ruleset drops only the copy in the FORWARD chain, not the one in the INPUT chain which is received by the local dhcpd. The locally-generated DHCP reply is sent through the OUTPUT chain and is not dropped either. Bottom line : you must drop DHCP traffic on the TAP interface in the INPUT and OUTPUT chains too. Or drop it on the "main side". -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
