Re: Bridge / routing

As far as I know, if it leaves through eth1, it can be 'got at' by iptables. Try using a LOG target to test it with. Somebody here who knows more than I do about this may be able to shed some light on it.
I have definitely been able to MARK packets with IPTables even though I am bridging them. 


Regards,
             Leigh
 
Leigh Sharpe
Network Systems Engineer
Pacific Wireless
Ph +61 3 9584 8966
Mob 0408 009 502
email [email protected]
web www.pacificwireless.com.au

-----Original Message-----
From: Walt Reed [mailto:[email protected]] 
Sent: Tuesday, September 12, 2006 11:41 PM
To: Leigh Sharpe
Cc: ebtables-user; waltlist
Subject: Re: [Ebtables-user] Bridge / routing

Well, that's what I'm hoping, although I don't know how to do this since
I'm using a bridge. As I understand it, things don't flow the same
through IPTables when using a bridge. Aren't the rules bypassed for eth1
and 2?

On Tue, Sep 12, 2006 at 01:27:06PM +1000, Leigh Sharpe said:
> Wouldn't an IPTables rule on eth1 do all of this? 
> Anything with a source IP on the 192.168 address gets SNATted as it exits eth1.
> If it doesn't exit eth1, it simply gets routed to the appropriate destination, out eth2.
> 
> Regards,
>              Leigh
>  
> Leigh Sharpe
> Network Systems Engineer
> Pacific Wireless
> Ph +61 3 9584 8966
> Mob 0408 009 502
> email [email protected]
> web www.pacificwireless.com.au
> 
> -----Original Message-----
> From: Walt Reed [mailto:[email protected]] 
> Sent: Thursday, September 07, 2006 1:23 AM
> To: [email protected]
> Subject: [Ebtables-user] Bridge / routing
> 
> Cc: 
> Bcc: 
> Subject: Bridge + routing?
> 
> I have a bridge / firewall that is working perfectly on ubuntu dapper:
> 
> /usr/sbin/brctl addbr br0
> /usr/sbin/brctl addif br0 eth1
> /usr/sbin/brctl addif br0 eth2
> /usr/sbin/brctl setfd br0 1
> /sbin/ifup br0
> /sbin/ifconfig eth1 0.0.0.0
> /sbin/ifconfig eth2 0.0.0.0
> 
> The interfaces file for br0 looks like:
> iface br0 inet static
>  address 69.122.123.166
>  netmask 255.255.255.128
>  network 69.122.123.128
>  broadcast 69.122.123.255
>  gateway 69.122.123.129
> 
> eth2 is connected to a switch and all the "Group A" client machines.
> eth1 is connected to a Cisco router with the IP 69.122.123.129.
> 
> All the "A" clients get their IP addresses via a DHCP server on the far side
> of the router (or the router itself. Not sure - it's a "managed"
> router) and the default gateway is set to the router's IP.
> 
> It's a situation where there was no firewall at all, so the linux box
> as the bridge / firewall protects the clients. All is happy.
> 
> Now I need to add a private network on eth3 - 192.168.1.1/24.
> eth3 connects to a dedicated switch with a bunch of "Group B" client machines.
> 
> I need to NAT "B" clients on the 192.168 net to use a dedicated NAT address
> (69.122.123.254) when accessing the internet, but want to ROUTE
> bidirectionally to the "A" clients on eth2. This is so eth2
> "A" clients (which have real internet addresses) can access printers and
> such on "B" (192.168.1.x.)) Likewise, "B" clients (wireless notebooks, etc.)
> off eth3 need to access "A" file servers on eth2.
> 
> Routing from the 192.168 net seems like it should be easy since the
> clients have 192.168.1.1 as the gateway address, but the IP for the
> 69.122.123.128 net is on br0 and not eth2. I don't want the cisco seeing
> the 192.168 addresses at all.
> 
> Here is a (bad) ascii diagram...
> 
> 
> Group A clients
> 69.122.123.130-254
>    |
>    |             +----------------+           69.122.123.129
>    |             |                |           +-------+
> switch ---- eth2-| Bridge br0     |-eth1 ---- | Cisco | ----- Internet
>                  | 69.122.123.166 |           +-------+
>                  +-------|--------+
>                        eth3
>                     192.168.1.1
>                          |
>                          |
>                        Switch
>                          |
>                          |
>                     Group B clients
>                     192.168.1.2-254                     
> 
> 
> So, how do I do this? It seems I need to:
> 
> 1) Intercept packets entering eth2 that are destined to 192.168 and
> route them out eth3 rather than continuing on to the default gateway of
> 69.122.123.129...
> 
> 
> 2) NAT eth3 (192.168) traffic as 69.122.123.254 if the destination is the internet only
> 
> Is that all or is there something I'm not thinking of?
> 
> I couldn't find any examples that match my situation...
> 
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Ebtables-user mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/ebtables-user
> 

-- 
Walt Reed
[email protected]
Office: 207-753-7333
Cell: 207-577-0699
http://www.vinq.com


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642