Re: Vlans

Julien VARLET wrote:
> I read that ebtables can do vlan filtering. I would like to have this configuration :
> switch (VLANs) <--> bridge filtering <--> switch (VLANs)

This is very doable.

> I would like to know if ebtables is vlans transparent for 802.1Q by default.

I can't say for sure if it is or is not.  However I can explain something 
that I did and how I did it which I think is along the lines of what you are 
wanting to do.

I had a client with a large network (dorm / sorority) that kept getting 
infected by one system being infected and then attacking other hosts on the 
LAN.  To help thwart this I subdivided the LAN in to approximately 25 VLANs. 
  I trunked out of the switch in to the Linux bridge running EBTables.  I 
used EBTables to set up a layer 2 firewall to prevent each tenant (if you 
will) VLAN from being able to communicate with each other VLAN.  I.e. the 
default forward policy was DROP.  I added rules that allowed traffic from 
each tenant VLAN to be forwarded to or from the interface that was connected 
to the internet.

With this set up I was able to create one large bridge that had all the VLAN 
interfaces plus the internet interface.

One thing to consider:  If you enable the option in the kernel that allows 
IPTables to see layer 2 bridged traffic you will need to allow forwarding 
via IPTables as well.  If you do not enable said kernel option, you do not 
even need to interface with IPTables.

I did have other issues to content with, namely the switches that I was 
working with did not like the existence of any MAC on more than one VLAN. 
To accomplish this I had to do some major SNATing and DNATing with EBTables.

Once everything was figured out, we have not had any where near the problems 
after the VLANing that we had prior.  The problems dropped from 2 - 3 major 
network infections per year to a minor one every 3 years.

If you want more gory details, just ask.



Grant. . . .

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642