Re: Bridging and filtering traffic

Grant Taylor wrote:
> Michael Milner wrote:
>> Can bridge-nf be modified to let me filter PPPoE traffic with iptables?
>
>> I would like to let all non-IP traffic to be bridged as normal, however
>> if
>> there is IP traffic encapsulated within a PPPoE session, I would like to
>> pass the IP packet through iptables but still retain the original PPPoE
>> header so that after iptables, the original packet can be reconstructed
>> with the PPPoE header back in place.
>
> I'm not sure how much of what you are wanting to do can be done directly
> with IP/EB/ARP Tables.
>
> I'd say that you can use IPTables with the Layer7 match to look in side
> of the PPPoE packet and see if the encapsulated packet is an IP packet
> or not and take action there in.
>

To my knowledge, IPTables will never see the PPPoE packets because the
kernel does not know they contain IP.

I am currently using ebtables with the ulog target.  All packets are
ulogged to user space then dropped.  In user space I can strip the packet
and bridge the packet manually.  The problem is that this is very slow.  I
only really need to see a few packets in userspace.

With plain IP packets, the iptables QUEUE target allows me to separate my
packets of interest and send only them to userspace for processing.  The
problem is when I have the PPPoE headers, the packets never make it to
iptables because they aren't IP, they're PPPoE/PPP/IP.

> However, I do not think it is possible to decapsulate and then
> recapsulate PPPoE packets directly with IPTables kernel space.

I figured this would be something similar to bridge-nf.  In bridge-nf, the
original ethernet header is preserved through iptables so that it can be
replaced later.  Could I modify the bridge-nf code so that it would also
strip (and save) any PPPoE/PPP headers that were present?  It would
probably require modifying the skb->mac variable to hold the PPPoE stuff
in addition to the Ethernet header.

Any idea if this would be feasible?

Thanks!

Mike



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV