Re: Filtering arp on vlan trunk interface

Op do, 30-08-2007 te 23:29 +0200, schreef xerofun:

> So thinking about your explanation, I tried the following:
> 
> Bridge chain: INPUT, entries: 20, policy: ACCEPT
> -s 0:0e:15:33:9f:1b --logical-in br0 -j DROP , pcnt = 229 -- bcnt = 10534
> -s 0:0e:15:33:9f:1b -i vlan111 -j DROP , pcnt = 0 -- bcnt = 0
> Bridge chain: FORWARD, entries: 60, policy: ACCEPT
> -s 0:0e:15:33:9f:1b --logical-in br0 -j DROP , pcnt = 36 -- bcnt = 1656
> -s 0:0e:15:33:9f:1b -i vlan111 -j DROP , pcnt = 0 -- bcnt = 0
> 
> So this only matches the first rule, the counters of the second rules in every
> chain are never matched/incremented. I'm definetly not trying to proof you
> wrong, or maybe I just get something wrong here, but shouldn't the ARP request
> be filtered by the second rule before it "reaches" br0? Following your
> explanation - which sounds absolutely reasonable - this should be the way, right?

Use ebtables --log --log-arp to see how ebtables sees the packets. If
something looks wrong please mail it here. Shouldnt you also have a -i
eth2 rule? Isn't your arp table populated through that input port?

> > With {arp,ip,ip6}tables you can filter vlan encapsulated packets.
> 
> @Bart: So did you just forget "eb" in the curly brackets or did you mean that
> these are the right tools to do so?

I didn't forget "eb", that's basically why that entry was in the todo
list. If the bridge port is a vlan device (like your vlan111) then you
can filter on the arp though.

> What I really want to do is to prevent mac addresses to reach the bridge mac table.

"arptables -A INPUT -j DROP" should do this. Using the ebtables
PREROUTING and/or INPUT chain should do this too.

cheers,
Bart



-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/