Re: SRC MAC address masking for on-bridge service communications

Bart De Schuymer <[email protected]> Sun, 01 Apr 2007 12:01:37 +0200
Newsgroups gmane.linux.network.bridge.ebtables.user
Message-ID <[email protected]>
Op za, 31-03-2007 te 11:57 -0800, schreef Jonothan Kane:
> Greetings;
> 
> I'm trying to setup a completely transparent brouting firewall/bridge.
> Since I'm proxying a protocol with a userspace server, I've had to setup
>  a BRouting firewall/bridge.  Much akin to a brouted squid proxy setup.
> 
> My problem is that the Machine currently exposes it's MAC address as the
> SRC MAC for any communication that flows through the userspace proxy service.
> 
>  192.168.2.0/24
> Internal Network
> |
> |
> |  _____________________________________
> | | Bridge/Firewall Machine            |
> | |          ____ Proxy   ____         |
> | |          |    Service    |         |
> | |  ________|               |_______  |
> | |  |                              |  |
> | |  |                              |  |
> | | /                                \ |
> |_|/_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ \|__
>  A |____________________________________|B |
>                                           |
>                                ___________|
>                                |
>                           10.0.0.0/24
>                          External Network
> 
> Is there a way to setup the system up such that all traffic to/from
> the machine has no MAC addresses associated with the machine?
> ie The bridges MACs remain hidden ?

I don't think that's easy to implement in ebtables purely based on the
Ethernet header, but it's probably doable on a protocol base.
Does the bridge have an IP address? How do you keep the IP source
address different from the bridge's IP address?
Can't you construct the complete packet (including Ethernet header) in
userspace and send it out on the right interface (perhaps br0)?

cheers,
Bart



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV