paddy joesoap a écrit : >> >> With a SOHO router, it depends on how the built-in switch works. If each >> ethernet port is or can be set as a separate interface (possibly through >> the use of VLANs), then you can build a Linux bridge and inspect bridged >> traffic with ebtables or bridge-nf + iptables. [...] > My home router is a Linksys WRT54GL with a 4 port switch. I have > installed DD-WRT on it. It looks like the built-in switch of the WRT54GL is VLAN-capable, so it should be possible to set each LAN port in a different VLAN, create VLAN interfaces for each VLAN on the internal interface eth0 (like the WAN port and its corresponding VLAN interface vlan1, cf. internal diagram e.g. at <http://gablog.eu/online/node/24>) and bridge them together. Oops, I don't know whether DD-WRT supports ebtables or has bridge-nf enabled. > If I understood what you said about firewalls and switches in broad > terms (possibly in an enterprise setting) I can essentially "trick", > for a want of a better term, the switch to forward all traffic to the > firewall for inspection regardless if the packets are outbound or not. It is possible, but I didn't mean that. I meant that the switch itself could act as a firewall, if it is sophisticated enough. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
