Re: Rules don't allow my servers packets through

You will also want to allow ARP through, or you won't be able to map IPs
to MAC addresses across the bridge.

On Fri, 2006-01-06 at 12:27 +0000, Carlos Ramos wrote:
> I'm new to ebtables and i'm having a problem. I have a simple bridge
> that does nothing except forward packets from one interface to
> another. Both on the same network.
> 
> |packets| <------>bridge:eth0<->bridge:eth1 <-------> |packets|
> 
> I want to filter the packets and only allow http/https, DHCP  packets.
> I have 3 servers that should be allowed any kind of trafic, the
> servers have the ips:
>  10.10.1.8, 10.10.1.10, 10.10.1.20
> 
> these are my rules:
> 
> 
> [root@localhost ~]# ebtables -L
> Bridge table: filter
> 
> Bridge chain: INPUT, entries: 0, policy: ACCEPT
> 
> Bridge chain: FORWARD, entries: 20, policy: ACCEPT
> -p IPv4 --ip-src 10.10.1.10 -j ACCEPT
> -p IPv4 --ip-dst 10.10.1.10 -j ACCEPT
> -p IPv4 --ip-src 10.10.1.20 -j ACCEPT
> -p IPv4 --ip-dst 10.10.1.20  -j ACCEPT
> -p IPv4 --ip-src 10.10.1.8  -j ACCEPT
> -p IPv4 --ip-dst 10.10.1.8 -j ACCEPT
> -p IPv4 --ip-proto tcp --ip-dport 80 -j ACCEPT
> -p IPv4 --ip-proto tcp --ip-sport 80 -j ACCEPT
> -p IPv4 --ip-proto tcp --ip-dport 443 -j ACCEPT
> -p IPv4 --ip-proto tcp --ip-sport 443 -j ACCEPT
> -p IPv4 --ip-proto udp --ip-dport 67 -j ACCEPT
> -p IPv4 --ip-proto udp --ip-dport 68 -j ACCEPT
> -p IPv4 --ip-proto udp --ip-sport 67 -j ACCEPT
> -p IPv4 --ip-proto udp --ip-sport 68 -j ACCEPT
> 
> Bridge chain: OUTPUT, entries: 0, policy: ACCEPT
> 
> 
> 
> to activate everything i make:
> ebtables -P FORWARD DROP
> 
> and when i do that aparently everything works fine but then i notice i
> loose dns resolving.
> 
> the dns resolving is made through the server 10.10.1.20, if i go to
> the console of that server and try to ping www.google.com it fails, no
> ping, no dns resolution, no nothing... aparently the rules that accept
> everything comming in and out from 10.10.1.(8, 10, 20) are not
> working.... does any one know why?



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click