Re: Filtering arp on vlan trunk interface

Grant Taylor wrote:
> On 9/1/2007 1:27 PM, [email protected] wrote:
>> Yes, CONFIG_BRIDGE_NETFILTER is enabled in the kernel. The 
>> description of this option says "...will let arptables resp. iptables 
>> see bridged ARP resp. IP traffic."  Wouldn't this mean that disabling 
>> this option will lead to bridged ip traffic not being fed into 
>> iptables? This would be a major disadvantage in my setup, because 
>> this host indeed is a bridging firewall and needs to filter all of 
>> the traffic that's flowing through it.
>>
>> How would disabling this option affect the arp table of the bridge?
> 
> In short, you have EBTables, IPTables, and ARPTables all trying to 
> filter the same traffic.  IPTables and ARPTables usually operate on 
> traffic that comes in an interface that has an IP address bound to it (I 
> think) and not bridged traffic.  Thus when you have the "Bridged IP/ARP 
> packets filtering" enabled in the kernel IPTables and ARPTables do see 
> bridged traffic.
> 
> I would suggest that you try turning the "Bridged IP/ARP packets 
> filtering" option off and use EBTables to filter your arp packet(s).

Well, I already tried that, didn't change the situation. The MAC address of the
remote router was again filtered by ebtables but ended up in the bridge's mac table.

Didn't have the ebtable_nat extension loaded so far. I just played with it and
it looks like this is the right place for filtering. The mac is seen in tcpdump,
but is not learned by the bridge itself.

Thanks for your suggestions, they helped me to better understand the whole
process of filtering.

Best,

Lars

PS: Sorry for "spamming" the list with my other message.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/