Hi Pascal, On Mon, Nov 2, 2009 at 3:51 PM, Pascal Hambourg <pascal.mail@xxxxxxxxxxxxxxx> wrote: > Hello, > > paddy joesoap a écrit : >> >> Normally I think of firewalls as controlling packet flows that pass >> through it (for example:Internet to Intranet). >> >> Can netfilter also control traffic on the same subnet? > > Yes, if the traffic passes through it. This can be done by setting up a > filtering bridge using bridge-nf : the IP packets in bridged ethernet > frames will be filtered by iptables rules. I need to do some reading here. So thanks for this. But once I form a "bridge", I can then apply standard iptables rules, right? Will it only inspect packets at layer 2 and not layer 3,4 and 7? Again, I better read about the area before posing such questions. > >> Suppose I had the following set up: >> Internal Machines 1,2 and 3 are on the same subnet governed by the >> netfilter firewall. >> >> ---------- Machine1 >> Internet ------ Netfilter Firewall ---------- Machine2 >> ---------- Machine3 > > Does the Firewall bridge Machine1-3 together (and thus have a separate > ethernet interface for each one) or is there an ethernet switch between > them ? A switch won't pass the traffic between Machine1-3 to the Firewall. I was thinking of a typical SOHO router (combined switch, routing, nat and firewall) or a simple standalone linux box that has a switch (even outdated hub!) connected to it and then the 3 machines on the far side of the switch. This is currently just a hypothetical question. I presumed that given a firewall can examine packets from the internal network outbound, that it can also examine packets that are never routed externally. Maybe, for example, I have a laptop, a server and printer in my network. Perhaps only the laptop can print and access the server. The printer cannot communicate with the server. Now, I know I can install netfilter locally on the server and even TCP wrapper but I am interested to know from a security in depth point of view, if a firewall also control access amongst machines/systems on the same network? (filter by ip addresses on the same subnet. I presume the firewall machine needs also be a router). > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
