Re: arptables and MAC DNAT

Op di, 21-02-2006 te 03:47 +0100, schreef Arne Bernin:
> Hi all,
> 
> I am trying to figure out if the following scenario is possible
> with linux and arptables:
> - I want to use a virtual MAC Adress and a virtual IP adresss on a
>  network card.
> - The Virtual MAC is applied via arp -s on a client machine, so no arp
> resolution is required
> - The Virtual MAC is added to the nics HW Filter using ipmaddr
> - The Virtual ip is set using "ip addr add"
> - arptables is used to make a dnat/mangle for the packets coming in into
> eth0 with the Virtual MAC as their target. The packets are altered to
> have the real MAC Adress of eth0 as their destination MAC.
> - packets leaving the machine with a ip source of the Virtual IP are
> altered to have a source mac address = Virtual MAC address.
> 
> Please note that i don't want to put the device in promiscous mode. I
> was able to see the packets coming in with the Virtual MAC if i added
> the Virtual MAC with ipmaddr to the device using tcpdump (non
> promiscous), so i assume the packets are handled correct by the hardware
> filters. But even after adding a arptables mangle rule in the INPUT
> chain i don't see the packages in the iptables mangle/Prerouting chain.
> So i wonder, what i am missing, maybe just that the above will not
> work...So, if anyone can comment on this, please do!

arptables only sees arp packets, while it seems you want it to see all
packets. ebtables can do this, but you'll need to make eth0 a bridge
port.

cheers,
Bart




-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642