Re: --snat-arp coming? or should I find any other aproach?

Santiago Garcia Mantinan wrote:
> Hi!
> 
> I'm trying to bridge together a couple of ethernet devices and a wireless
> one, the wireless AP does of course drop all the packages that come from an
> unassociated mac into its wireless interface, so I thought I could snat the
> MAC addresses of the packages going out of my bridge through it's wireless
> interface into the AP, and so I set up ebtables with an snat rule.
> 

Yeah, this is a real problem because wifi devices use a 3 address frame 
header format which basiclly means that you can't do real bridging thru 
them, you have to resort to hacks instead. What you're getting with 3 
addresses, are the address of the accesspoint, the address of the 
station behind the accesspoint that originated the frame, and the 
address of the wireless client device (and not necessarilly the address 
of the station behind the client device that the frame should be 
addressed to). This breaks all sorts of stuff and is a great flaw that 
somebody should have picked up on when the wireless protocols (802.11) 
were being drafted. It's fixed when using 'wds', which allows true 
bridging, but not everything supports it.

Anyways, this can be tricky or easy depending on the wireless device 
you're using, because some of them do in fact have protocol layer 
support where they do address translation on behalf of clients on their 
wired sides. Since you're on the ebtables list however, I think you've 
probbly got linux and an ethernet or two plus a wireless card like a 
prism or atheros. Setting up WDS is going to be the best thing for you, 
if your AP supports it. If not, then proxy arp would be your next best 
answer.

ebtables natting would be even more useful if it included deeper 
protocol support. For example, natting PPPoE protocol behind 1 mac 
address would be possible (use pppoe session id as the key). There's no 
dynamic learning possible with ebtables today so you have to statically 
program the mac address of the station(s) on the wired side, but there's 
no reason why ebtables couldn't figure it out (like connection tracking 
done now in iptables).


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV