brouting problem
"Egi, Norbert" <[email protected]> Mon, 16 Apr 2007 17:52:21 +0100
| Newsgroups | gmane.linux.network.bridge.ebtables.user |
|---|---|
| Message-ID | <[email protected]> |
Hi, Despite that it looks quite simple, I can't make brouting work the way I want. I've got a Linux box with several ethernet interfaces and there are two bridges, each with two interfaces(eth2-eth3 and eth4-eth5) attached to. Both of the bridges are used to connect machines on the same sub-network to each other, but I also want to route packets between the two networks the bridges belong to (and to another interface that leads to the outside world). It works fine actually, but to avoid double queuing and make the forwarding faster I wanted to use brouting provided by ebtables, unfortunately with not much success so far. I have gone through ebtables' examples and did the following: brctl addbr br0 brctl addbr br1 brctl addif br0 eth2 brctl addif br0 eth3 brctl addif br1 eth4 brctl addif br1 eth5 ifconfig eth2 0.0.0.0 ifconfig eth3 0.0.0.0 ifconfig eth4 0.0.0.0 ifconfig eth5 0.0.0.0 ifconfig br0 10.0.0.1 netmask 255.255.255.0 ifconfig br1 11.0.0.1 netmask 255.255.255.0 echo 1>/proc/sys/net/ipv4/ip_forward The default gateway for the machines in 10.0.0.0/24 and 11.0.0.0/24 are set to 10.0.0.1 and to 11.0.0.1, respectively. With this everything works fine, but slower than I wanted. So I did the following based on the examples and on the info I could find in the mailing archive to avoid double queuing: ebtables -t broute -A BROUTING -p IPv4 -d MAC_OF_ETH2 -j DROP ebtables -t broute -A BROUTING -p IPv4 -d MAC_OF_ETH3 -j DROP ebtables -t broute -A BROUTING -p IPv4 -d MAC_OF_ETH4 -j DROP ebtables -t broute -A BROUTING -p IPv4 -d MAC_OF_ETH5 -j DROP It seems to me that it should work, but unfortunately it doesn't. If I ping 10.0.0.1 (or anything in 11.0.0.0/24) from one of the machines in 10.0.0.0/24 no reply arrives, however, the arp entry for 10.0.0.1 is updated. So it reacts to ARP requests, but IP packets got dropped somewhere. If I flush the ebtables' BROUTING chain (with 'ebtables -t broute -F') everything works again. I've also tried '-j redirect --redirect-target DROP' instead of '-j DROP', but it doesn't work either, besides that the arp table is updated for the pinged gateway in this case as well. Could you tell me what I'm missing here and why my setup doesn't work? Many thanks, Norbert ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/