Re: MAC NAT

Hi,

sure you understood what my question was ?

This doest do a redirect.

It is pretty clear that the target MAC of the paket has to be changed  
someway.

I have to ACCEPT the packet anyway, otherwise it will be dropped, but  
just ACCEPTing packets in the FORWARD chain does not send them to a  
differend host.

The two subnets that are on eth1, have their default-gateway on eth0  
of the bridge. What I want is: that the bridge does a little bit  
routeing for packets that traveling from one of these subnets to the  
other (that are both on eth1), so that the default-gateway on eth0  
doesnt need to get involed. The thing ist: I can not really protect  
me from spoofing, cause currently I have to accept packets from the  
"outside" carrying my own addresses as source and destination.

Currently the packets travel like this:
- enter the firewall at eth1, accepted by iptables rules, left on eth0
- the router on eth0 sends then back
- enter the firwwall on eth0, accepted by iptables rules, left on eth1

My goal is:
- packets anter on eth1, are brouted/NATed/whatever , left on eth1


the router has 10.0.0.1 and 10.0.0.80, the two subnets are  
10.0.0.0/28 and 10.0.0.80/28, the hosts from one subnet cannot send  
packets to the other subnet directly, they share the same physical  
network, but they of corse can only reach each other via a router,  
but I want to shortcut their way at my firewall, sitting in front of  
that router.

/sebastian



Am 09.12.2005 um 06:37 schrieb ramsurrunv-aD7nsNzqxXzCK/[email protected]:

> Dear Sebastian,
>
> you can use iptables on the bridge itself to do this redirection:
>
> iptables -A FORWARD -i eth0 -o eth0 -s 192.168.10.0/24 -d  
> 192.168.10.0/24
> -j ACCEPT
>
> U will have to change the eth0 to br0, i believe..
>
> Hope it helps..
>
> Regards,
> Visham
>



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click