Thanks for this insightful information Pascal. I'll take stock and get reading :-) On Mon, Nov 2, 2009 at 10:23 PM, Pascal Hambourg <pascal.mail@xxxxxxxxxxxxxxx> wrote: > paddy joesoap a écrit : >>> >>> With a SOHO router, it depends on how the built-in switch works. If each >>> ethernet port is or can be set as a separate interface (possibly through >>> the use of VLANs), then you can build a Linux bridge and inspect bridged >>> traffic with ebtables or bridge-nf + iptables. > [...] >> My home router is a Linksys WRT54GL with a 4 port switch. I have >> installed DD-WRT on it. > > It looks like the built-in switch of the WRT54GL is VLAN-capable, so it > should be possible to set each LAN port in a different VLAN, create VLAN > interfaces for each VLAN on the internal interface eth0 (like the WAN > port and its corresponding VLAN interface vlan1, cf. internal diagram > e.g. at <http://gablog.eu/online/node/24>) and bridge them together. > Oops, I don't know whether DD-WRT supports ebtables or has bridge-nf > enabled. > >> If I understood what you said about firewalls and switches in broad >> terms (possibly in an enterprise setting) I can essentially "trick", >> for a want of a better term, the switch to forward all traffic to the >> firewall for inspection regardless if the packets are outbound or not. > > It is possible, but I didn't mean that. I meant that the switch itself > could act as a firewall, if it is sophisticated enough. > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
