Re: interface or source ip match using brouting - transparent proxy

* Bart De Schuymer <[email protected]> [2006-04-20 19:57]:

> > so when I want to redirect only trafic coming from LAN i try using "-i
> > eth1", but that redirects trafic from eth0 as well, but it shouldnt?
> > 
> > when I want to redirect trafic coming only from ip range 10.0.0.0/8 I
> > use rule --ip-src 10.0.0.0/8, but traffic passing bridge from other
> > ips get's caugh as well.
> > 
> > but it catches only "--ip-destination-port 80". So at least one rule
> > works. Why "-i eth1" and "--ip-src 10.0.0.0/8" does not do filtering
> > for me?
> 
> They should also work. Make sure you start from empty tables. Anyway,
> you can do a number of tests by looking at the packet counters and
> logging the traffic that matches a specific rule.



I start from empty tables. I trid loging trafic and it logs correctly, but works incorrectly. I mean: I use the same broute rule:

Bridge chain: BROUTING, entries: 1, policy: ACCEPT
-p IPv4 -i eth0 --ip-src 10.0.0.0/8 --ip-proto tcp --ip-dport 80 --log-level debug --log-prefix "EBFW" --log-ip --log-arp -j redirect

eth0 now is internal card, and it logs and works ash should be, but when I change the rule from eth0 to eth1, it does not log anymore, but it still redirects traffic locally, but it shouldn't?!?


using ubuntu 2.6.15-20-686 #1 SMP PREEMPT Tue Apr 4 18:37:00 UTC 2006 i686 GNU/Linux
bridge-utils, 1.0.6

 brctl show
bridge name     bridge id               STP enabled     interfaces
br0             7fff.0002b3b2d157       no              eth0
                                                        eth1
                                                        eth2
 ip route
10.0.0.0/8 dev br0  proto kernel  scope link  src 10.0.0.2
default via 10.0.0.1 dev br0

Andrius


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642