groking FORWARD chain

Hi folks,

I'm hoping somebody can set me straight on the use of the FORWARD  
chain.  At least, that's where I think my problem is (please prove me  
wrong!).

Scenario:

I want to do some basic MAC-based filtering between a potentially  
hostile machine A and machine B on a network.  Machine A is to be  
allowed to speak to Machine B only (and ideally I'll only let Machine  
B see Machine A's ARP broadcasts as well with some mangling later).  
For now, I just want to implement MAC-based --src and --dst rules.

So, the goal is to put an ebtables box between Machine A and the rest  
of the network.  For the sake of economy (possible replication for  
other machines), reliability (solid-state), and power consumption,  
I've got a Linksys WRT54GL with DD-WRT v24rc3 on it, including the  
ebtables and ebtable_filter modules (kernel 2.4.35).  I started out  
with OpenWRT Kamikaze but they claim ebtables is unstable on their  
kernel.

My general strategy is to assign each of its ports 0-4 to their own  
VLAN and bring two VLAN's into a bridge, where I'll apply the  
ebtables rules.  Setup looks like this:

   iptables -F
   iptables -X
   ifconfig vlan1 0.0.0.0 up
   ifconfig vlan2 0.0.0.0 up
   ifconfig vlan3 0.0.0.0 up
   ifconfig vlan4 0.0.0.0 up

   brctl addbr filter
   brctl setageing filter 0
   brctl setfd filter 0
   brctl addif filter vlan1
   brctl addif filter vlan2
   ifconfig filter 0.0.0.0 up

This works perfectly.  I can plug two machines into the ports for  
vlan1 and vlan2 and they can ping each other as soon as the bridge  
comes up.  So far so good.  However, as soon as I:

   insmod ebtables

the pings stop flowing.  Adding:

   insmod ebtable_filter

doesn't improve that situation.  FWIW, all chains are default ACCEPT  
policy, in ebtables as well as iptables.  My guess at this point is  
that ebtables doesn't know it's supposed to be forwarding those  
packets, but this is where I'm confused, e.g. does it decide what  
it's supposed to forward or does it forward everything it doesn't  
know what to do with?

As an aside, I've tried playing with ebtables on the br0 bridge,  
which is the default LAN connection on this box.  Interestingly, I  
can filter based on --src and --dst for the machine sending the ICMP  
Echo Request, but if I try to filter on the --src or --dst for the  
machine sending the ICMP Echo Reply it doesn't have any effect.  If I  
capture packets on the target machine I see the ICMP Echo Reply  
coming from the router's IP address, which isn't what I was expecting  
(I was expecting the ethernet and IP source on the packet to be from  
Machine A, as in a Proxy ARP scenario).  This may just further  
illustrate my confusion, I'm not sure.  Anyway, besides that it  
illustrates that the ebtables and ebtable_filter modules do work on  
that interface.

Can anybody illuminate the source of my confusion or suggest a more  
appropriate strategy?  I'll summarize once I have the canned solution.

Thanks,
-Bill

-----
Bill McGonigle, Owner           Work: 603.448.4440
BFC Computing, LLC              Home: 603.448.1668
[email protected]           Cell: 603.252.2606
http://www.bfccomputing.com/    Page: 603.442.1833
Blog: http://blog.bfccomputing.com/
VCard: http://bfccomputing.com/vcard/bill.vcf


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/