Re: "Simple?" Need an example of rules, please...

On Sun, 18 Dec 2005 [email protected] wrote:

 Hi, sorry for the late reply

> I have been reading, surfing, and generally pulling my hair out trying to
> figure out how to write the ebtables rules I need to use...  Would someone
> point me in the right direction, please?
>
> Let's assume this setup:
>
> Internet   <===== eth1 >    Bridge/Firewall   < eth2 =====>   LAN
>
> All machines connected to the LAN use public IPs and the bridge machine has
> no IP at all.  I found an article that calls me "uber paranoid" for giving  no
> interface an IP, but hey-- why not?  :-)
>
> Configuring the bridging part of this little adventure was a piece of  cake.
> All works there as it is supposed to work-- and then came time to  write the
> ebtables rules... and I've consumed four pots of coffee Googling  for anything
> resembling an example, etc.  This ain't iptables, that's for  sure...
>
> Once I see the jist of things, I'm sure I can take it from there...
>
> I want to write rules such as:
>
> "Allow internet to access ports 80, 25 and 110 of  70.105.61.235"
> "Allow internet to access ports 80 and 1354 of 70.105.61.236"
> "Allow 70.105.61.235 to access the internet using port 25"
> "Allow 70.105.61.236 to access the internet using port 1354"

 to do this you need simple filtering iptables rules, not ebtables.
Maybe this is why couls not find an ebtables recipie on the net.
Althoght this is also possible with ebtables, but with ebtables
you would have a stateless firewall, while with iptables you could make it
statefull.
If you heed help with iptables rules let me know.

>
> The key here is the existence of multiple servers behind this bridge with
> differing rules needs.
>
> >From the man pages, and the assorted "examples" on SourceForge, I'm just  not
> "getting it."  Can you help?  I'd really appreciate it!
>
> Thank you,
>
> Eriks
>

            _.-..
          ,'9 )\)`-.,.--.
          `-.|   Piavlo  `.
             \, Alexander \)
              `.  )._\   (\
               |//   `-,//
               ]||    //"
               ""     ""



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click