Re: SRC MAC address masking for on-bridge service communications
Bart De Schuymer <[email protected]> Sun, 01 Apr 2007 12:01:37 +0200
| Newsgroups | gmane.linux.network.bridge.ebtables.user |
|---|---|
| Message-ID | <[email protected]> |
Op za, 31-03-2007 te 11:57 -0800, schreef Jonothan Kane: > Greetings; > > I'm trying to setup a completely transparent brouting firewall/bridge. > Since I'm proxying a protocol with a userspace server, I've had to setup > a BRouting firewall/bridge. Much akin to a brouted squid proxy setup. > > My problem is that the Machine currently exposes it's MAC address as the > SRC MAC for any communication that flows through the userspace proxy service. > > 192.168.2.0/24 > Internal Network > | > | > | _____________________________________ > | | Bridge/Firewall Machine | > | | ____ Proxy ____ | > | | | Service | | > | | ________| |_______ | > | | | | | > | | | | | > | | / \ | > |_|/_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ \|__ > A |____________________________________|B | > | > ___________| > | > 10.0.0.0/24 > External Network > > Is there a way to setup the system up such that all traffic to/from > the machine has no MAC addresses associated with the machine? > ie The bridges MACs remain hidden ? I don't think that's easy to implement in ebtables purely based on the Ethernet header, but it's probably doable on a protocol base. Does the bridge have an IP address? How do you keep the IP source address different from the bridge's IP address? Can't you construct the complete packet (including Ethernet header) in userspace and send it out on the right interface (perhaps br0)? cheers, Bart ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys-and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV