Re: MAC snat by source IP address

Op wo, 17-10-2007 te 09:41 +0100, schreef Pete Philips:
> Bart De Schuymer wrote:
> > In ebtables PREROUTING the original IP source address will still be
> > there so you can mark the packets there and use that mark in
> > POSTROUTING.
> 
> Thanks for the information. Unfortunately I'm still not having any luck. Here's
> the rules I have:
> 
> ebtables -t nat -A PREROUTING -p ipv4 --ip-protocol 6 --ip-source <SERVER source IP) -j mark
> --set-mark 0x01
> ebtables -t nat -A POSTROUTING --mark 0x01 -j snat --to-source <SERVER MAC>
> 
> The problem seems more fundamental than failing to match the IP address. If I cut this
> right down to match everything:
> 
> ebtables -t nat -A PREROUTING j mark --set-mark 0x01
> ebtables -t nat -A POSTROUTING --mark 0x01 -j snat --to-source <SERVER MAC>
> 
> It still does not do the MAC SNAT. Is there a problem with my syntax or maybe my
> hardware/software setup?

The problem will be that you're using a proxy on the bridge, so you're
not really routing/bridging. The proxy is responsible for sending the
packets out and the firewall loses all information of its corresponding
incoming packet.
There's no easy solution to this AFAIK...

cheers,
Bart



-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/