EBTables bridge for in/out internet access

Hi,

This is what I'm planning:

                      +--------+             +--------------------------+
provider <----> eth0 | bridge | eth1 <----> | http server with real ip |
                      +--------+             +--------------------------+
                         eth2
                          ^
                          |
                      +--------+
                      | host   |
                      | without|
                      | real   |
                      | ip     |
                      +--------+

I can't change any network settings on http server and can't get any 
other real ip address, but I need to:

1) allow access to http server only for tcp/ip and port 80
2) allow host without real ip to full as possible access to any other 
hosts (http server and internet hosts) with ip nat.

I know that the best way is to use router for dnat (for http server) and 
  snat (for inner host without real ip address) but can't do this 
because I can't recofigure http server or reuse only one ip address in 
any other way.

How can I create a configuration with bridge? Can anybody give me a 
sample configuration?

First task is more simple: I can use ebtables as iptables for dropping 
all packets except tcp/ip packets for source or destination port 80. But 
how can I masquerade inner host packets with http server mac and ip 
addrress for any host except http server? How can I connect to http 
server from inner host?

What another rules need I use with this:

iptables -t nat -A POSTROUTING -i eth2 -s $INNER_IP -j SNAT --to-source 
$REAL_IP
ebtables -t nat -A POSTROUTING -i eth2 -s $INNER_MAC -j SNAT --to-source 
$REAL_MAC



--
Thanks,
ENP


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf