Re: MAC NAT

Op do, 08-12-2005 te 08:03 +0100, schreef Sebastian Böhm:
> Hi,
> 
> I have a question.
> 
> in the "simple examples" on the ebtables homepage there is a MAC NAT  
> example with the following limitation " If the host with MAC address  
> 54:44:33:22:11:00 is on the same side of the bridge as where the  
> packet arrived, this packet won't be sent out again.".
> 
> How can I do MAC NAT so that the paket can left the bridge on the  
> same interface it arrives ?

That's currently not possible without hacking the kernel code, sorry.

> My setup:
> 
> - two subnets on one physical network
> - alle connected to one router with has two IP-Addresses on that  
> interface (the default gateways for the two subnets)
> - a transparent firewall before the router
> - Goal: redirect traffic that goes from one of these subnets into the  
> other directly on the transparent firewall WITHOUT sending that  
> traffic to the router.

What you can probably do is redirect that traffic to the bridge box
itself and let the bridge box work as a "transparent gateway" for those
packets. Your bridge will need probably 2 ip address.
Something like this:
#brctl addbr br0
#brctl addif br0 eth0
#brctl addif br0 eth1
#ifconfig br0 $ip_subnet1
#ifconfig br0:1 $ip_subnet2
#ebtables -i $iface_network -d $subnet1 -j redirect
#ebtables -i $iface_network -d $subnet2 -j redirect
#ebtables -o $iface_internet -d $subnet1 -j DROP
#ebtables -o $iface_internet -d $subnet2 -j DROP

Doing this will make the IP stack see the packets with subnet
destination and should route them to the correct subnet computer (doing
an ARP lookup for its MAC address).

cheers,
Bart




-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click