Re: IP header match in a VLAN tagged packet

Kumara Sundaram ([email protected]) wrote on 18 October 2006 11:46:
 >I need to set traffic shaping rules based on IP address, port number,
 >MAC address and also VLAN ID. All matches are logical AND.

Me too!!
...

 >The following rule works for an untagged frame.
 >
 >Rule 1:
 >ebtables -t nat -A POSTROUTING -o eth0 -p IPV4 --ip-source
 >192.168.3.100 --ip-destination 192.168.3.212 --ip-protocol tcp
 >--ip-destination-port 5001 -j mark --set-mark 4 --mark-target ACCEPT
 >
 >The following rule works for a tagged frame
 >
 >Rule 2:
 >ebtables -t nat -A POSTROUTING -o eth0 -p 802_1Q --vlan-id 2
 >--vlan-encap IPV4  -s 00:30:1A:01:83:E0 -d 00:30:1A:28:FE:03 -j mark
 >--set-mark 4 --mark-target ACCEPT
 >
 >Introducing --ip-source in rule 2 mandates the protocol match to be
 >IPv4 (-p IPV4) and introducing --vlan-id in rule 1 mandates the
 >protocol match to be 802.1q (-p 802_1Q)
 >
 >I need to match a tagged frame for its VLAN ID as well as the IP
 >addresses,i.e, a combination of all the matches in rule 1 and rule 2
 >in a single rule.

Exactly what I need as well... I posted a question about this on Sep
26 but got no answer.

What's more intriguing is that arptables allows this combination. Why
ebtables doesn't?

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642