Re: Only allow one ipaddress through with redirect

Op vr, 20-01-2006 te 08:34 -0500, schreef [email protected]:
> Although still a newbie, I have ebtables working well thanks to you guys. I am
> using it to transparently redirect to dansguardian/squid using the following
> command and an iptables command.
> 
>  ebtables -t broute -A BROUTING -p IPv4 --ip-protocol 6 \
>         --ip-destination-port 80 -j redirect --redirect-target ACCEPT

As you're not really doing any brouting (that would be the DROP target),
it's more logical for you to use the PREROUTING chain of the nat table
instaid of the BROUTING chain of the broute table.

> The problem is that I need to exclude my bosses computer from the redirection
> and send him out to the internet without the redirection.
> 
> I have tried the following with the previous command
> 
>  ebtables -t broute -A BROUTING -p IPv4 --ip-source 192.168.0.13 -j DROP
> and
>  ebtables -t broute -A BROUTING -p IPv4 --ip-source 192.168.0.13 -j ACCEPT
> 
> What am I missing?

You can't drop packets in the BROUTING chain. The DROP target in that
chain has a special meaning. See the man page. Try something like this:

ebtables -t nat -A PREROUTING -p IPv4 --ip-protocol 6 --ip-source ! 192.168.0.13 \
--ip-destination-port 80 -j redirect --redirect-target ACCEPT

cheers,
Bart




-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642