Re: IP header match in a VLAN tagged packet

Bart,

Thanks for the response.

The sequence can be

1. matching VLAN ID in ebtables and marking the frame,
2. matching the mark in iptables, matching rest of IP header
parameters and marking it with a new mark,
3. using the new mark in tc filter rule as a handle

i need to operate the device as a complete bridge, i.e, it must work
as a switch even without assigning an IP address to the bridge
interface. Also, i need to set
/proc/sys/net/bridge/bridge-nf-call-iptables to 0 for various other
reasons. Since this prevents the iptables hooks from being called by
ebtables, i guess the above sequence can't be achieved. In short,
bridged traffic needs to be shaped.

Moreover, I could not find out a combination of ebtables rules that
can achieve this.

I feel a better option would be to extend ebt_vlan module to see
beyond the VLAN header if the encapsulation type is IPV4. I think it
involves reusing some code from ebt_ip module with the offset
increased by 4. Hope this goes into future development plans for
ebtables.

Thanks,
Kumara


On 10/21/06, Bart De Schuymer <[email protected]> wrote:
> Op wo, 18-10-2006 te 11:46 +0800, schreef Kumara Sundaram:
> > Hi,
> >
> > I need to set traffic shaping rules based on IP address, port number,
> > MAC address and also VLAN ID. All matches are logical AND.
>
> Protocols embedded in a vlan packet are currently not supported by
> ebtables. You can usually circumvent this by using iptables for the IP
> specific stuff (using marking where needed). See the "Vlans" thread on
> this mailing list.
>
> cheers,
> Bart
>
>
>

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642