Ebtables oddities - inconsistancies - and overall confusion ?
Alex.Upton-ppgqtt2TIWRWk0Htik3J/[email protected] Thu, 10 May 2007 12:08:19 -0400
| Newsgroups | gmane.linux.network.bridge.ebtables.user |
|---|---|
| Message-ID | <OF2183492F.C5F23DC4-ON852572D7.00564A00-852572D7.0058A746@instinet.com> |
Hello All,
I'm hoping someone can point me in the right direction, I've setup
ebtables to handle multicast routing a few years ago and I believe my
configuration is correct, however I don't appear to be seeing any
multicast joins going out my source interface.
I have provided my current config info below, hopefully this is enough to
explain the problem, but in short I can see the incoming packet and byte
count increasing for my source interface, however I do not see any active
joins go out the source interface, nor do the counters of the destination
interface increase.
Both source and destination interfaces are patched into separate switches.
The source interface is patched into a vlan where the multicast address of
239.255.45.140 is quite active. The destination interface is patched into
separate dedicated switch with out any clients. Basically this was done to
force the destination interface to have an active link.
When using a loopback on the destination interface it caused the data I
was reading to flood back through the bridged source interface until
ebtables was started and a DROP on all outbound IPV4 traffic for the
source interface was set.
Any help in figuring out what's wrong would be greatly appreciated.
Thanks
-Alex
OS: Fedora Core 6
Kernel : 2.6.20-1.2948.fc6
Interfaces:
eth0 = administrative non-bridged port
eth1 = bridged destination port
eth2 = bridged source port
eth3 = unused - non-bridged port
bridge-utils-1.1-2
ebtables-2.0.8-0.8.rc3.fc6
lsmod output:
ebtable_broute 6337 0
ebtable_nat 6593 0
ebt_log 8257 5
ebt_ip 6337 6
ebtable_filter 6593 1
ebtables 22465 5
ebtable_broute,ebtable_nat,ebt_log,ebt_ip,ebtable_filter
bridge 53465 1 ebtable_broute
Ethtool output for bridged interfaces:
ethtool eth1|grep Link
Link detected: yes
ethtool eth2|grep Link
Link detected: yes
Startup:
ebtables -F
ebtables -Z
ebtables -P INPUT DROP
ebtables -P OUTPUT DROP
ebtables -P FORWARD DROP
ebtables -A FORWARD -p IPv4 --ip-proto igmp -j DROP
ebtables -N TEST
ebtables -P TEST RETURN
ebtables -A TEST -p IPv4 --in-if eth2 --log --ip-dst
239.255.45.140 -j ACCEPT
# Removing the bridge
ifconfig br0 down
brctl delif br0 eth1
brctl delif br0 eth2
brctl delbr br0
echo [ Creating the bridge between eth1 and eth2 ]
brctl addbr br0
brctl stp br0 off
brctl addif br0 eth1
brctl addif br0 eth2
# Enable forwarding to br0
ebtables -A FORWARD --in-if eth2 --out-if eth1 -j WMD
# Bringing up the bridge
ifconfig br0 up
# Print ebtables counter stats
sleep 1
ebtables -L --Lc
Startup list and counter output:
Bridge table: filter
Bridge chain: INPUT, entries: 0, policy: DROP
Bridge chain: FORWARD, entries: 2, policy: DROP
-p IPv4 --ip-proto igmp -j DROP , pcnt = 8 -- bcnt = 224
-i eth2 -o eth1 -j WMD, pcnt = 721 -- bcnt = 40186
Bridge chain: OUTPUT, entries: 0, policy: DROP
Bridge chain: WMD, entries: 5, policy: RETURN
-p IPv4 -i eth2 --ip-dst 239.255.45.140 --log-level notice
--log-prefix "" -j ACCEPT , pcnt = 0 -- bcnt = 0
*****************************************************************
<<<Disclaimer>>>
In compliance with applicable rules and regulations, Instinet
reviews and archives incoming and outgoing email communications,
copies of which may be produced at the request of regulators.
This message is intended only for the personal and confidential
use of the recipients named above. If the reader of this email
is not the intended recipient, you have received this email in
error and any review, dissemination, distribution or copying is
strictly prohibited. If you have received this email in error,
please notify the sender immediately by return email and
permanently delete the copy you received.
Instinet accepts no liability for any content contained in the
email, or any errors or omissions arising as a result of email
transmission. Any opinions contained in this email constitute
the sender's best judgment at this time and are subject to change
without notice. Instinet does not make recommendations of a
particular security and the information contained in this email
should not be considered as a recommendation, an offer or a
solicitation of an offer to buy and sell securities.
*****************************************************************
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Ebtables-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ebtables-user