Re: Filtering arp on vlan trunk interface

On 9/1/2007 1:27 PM, [email protected] wrote:
> Yes, CONFIG_BRIDGE_NETFILTER is enabled in the kernel. The 
> description of this option says "...will let arptables resp. iptables 
> see bridged ARP resp. IP traffic."  Wouldn't this mean that disabling 
> this option will lead to bridged ip traffic not being fed into 
> iptables? This would be a major disadvantage in my setup, because 
> this host indeed is a bridging firewall and needs to filter all of 
> the traffic that's flowing through it.
> 
> How would disabling this option affect the arp table of the bridge?

In short, you have EBTables, IPTables, and ARPTables all trying to 
filter the same traffic.  IPTables and ARPTables usually operate on 
traffic that comes in an interface that has an IP address bound to it (I 
think) and not bridged traffic.  Thus when you have the "Bridged IP/ARP 
packets filtering" enabled in the kernel IPTables and ARPTables do see 
bridged traffic.

I would suggest that you try turning the "Bridged IP/ARP packets 
filtering" option off and use EBTables to filter your arp packet(s).



Grant. . . .

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/