Re: interface or source ip match using brouting - transparent proxy

Op di, 25-04-2006 te 17:56 +0300, schreef Andrius Kazimieras
Kasparavičius:
> * Bart De Schuymer <[email protected]> [2006-04-20 19:57]:
> 
> > > so when I want to redirect only trafic coming from LAN i try using "-i
> > > eth1", but that redirects trafic from eth0 as well, but it shouldnt?
> > > 
> > > when I want to redirect trafic coming only from ip range 10.0.0.0/8 I
> > > use rule --ip-src 10.0.0.0/8, but traffic passing bridge from other
> > > ips get's caugh as well.
> > > 
> > > but it catches only "--ip-destination-port 80". So at least one rule
> > > works. Why "-i eth1" and "--ip-src 10.0.0.0/8" does not do filtering
> > > for me?
> > 
> > They should also work. Make sure you start from empty tables. Anyway,
> > you can do a number of tests by looking at the packet counters and
> > logging the traffic that matches a specific rule.
> 
> 
> 
> I start from empty tables. I trid loging trafic and it logs correctly,
> but works incorrectly. I mean: I use the same broute rule:
> 
> Bridge chain: BROUTING, entries: 1, policy: ACCEPT
> -p IPv4 -i eth0 --ip-src 10.0.0.0/8 --ip-proto tcp --ip-dport 80
> --log-level debug --log-prefix "EBFW" --log-ip --log-arp -j redirect
> 
> eth0 now is internal card, and it logs and works ash should be, but
> when I change the rule from eth0 to eth1, it does not log anymore, but
> it still redirects traffic locally, but it shouldn't?!?

Log the packets as it enters the bridge and then see what kind of
alterations have been done to them. My guess is that the packets already
have the bridge's MAC address as destination.

cheers,
Bart




-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642