Re: Bridging and filtering traffic

Michael Milner wrote:
> Can bridge-nf be modified to let me filter PPPoE traffic with iptables?

You should be able to filter packet type to identify PPPoE traffic from
regular IP traffic.  Sorry, I do not have any references at hand to tell
you how.

> I would like to let all non-IP traffic to be bridged as normal, however if
> there is IP traffic encapsulated within a PPPoE session, I would like to
> pass the IP packet through iptables but still retain the original PPPoE
> header so that after iptables, the original packet can be reconstructed
> with the PPPoE header back in place.

I'm not sure how much of what you are wanting to do can be done directly
with IP/EB/ARP Tables.

I'd say that you can use IPTables with the Layer7 match to look in side
of the PPPoE packet and see if the encapsulated packet is an IP packet
or not and take action there in.

However, I do not think it is possible to decapsulate and then
recapsulate PPPoE packets directly with IPTables kernel space.  However,
you could probably use the NetLink Socket to send the matched packets
from IPTables in kernel space to a user space daemon that can do what
you are wanting.

> Is there any way I can strip off any PPPoE headers and store them with the
> packet for later use?

In kernel space, no, not that I'm aware of.  As previously stated I
think you could do this with NetLink Socket in user space.



Grant. . . .


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV