Re: Ebtables Problem

Hello Kamran,

1- I wouldn't know the specifics of Fedora, but on my system those logs 
show up when typing dmesg.  /var/log/dmesg usually just has the bootup 
output and won't be appended with new kernel messages.  I believe they 
should show up in /var/log/messages though.  Somebody who knows Fedora 
more might confirm that.
2- Most distributions do not have an ebtables script built-in.  There 
are several ways to make one.  You could do some sort of init 
(start/stop/save/reload) script for /etc/init.d which would call 
ebtables-save on 'save' and ebtables-restore on 'start', essentially 
dumping/reading the output of those commands in a file like 
/etc/ebtables.rules.  Maybe make 'stop' set flush all tables and set the 
policy to ACCEPT. and 'reload' would merely perform a stop/start.
3- Making an init script like described in point 2 would allow you to 
have your ebtables rules loaded on boot.  Most people just write a 
simple shell script, which they call on boot though and edit as needed.

Jonathan

kamran arshad wrote:
> I have Installed Ebtables on a Fedora Core 4 Machine with Ethernet 
> Bridging enabled. The bridge commands are as:
> # ifconfig eth2   0.0.0.0
>  # ifconfig eth3  0.0.0.0
>  # brctl addbr test
>  # brctl addif test eth2
>  # brctl addif test eth3 
>  # ifconfig test up
> The Linux bridge is working fine and I am able to pass the RDP, FTP, 
> ICMP as well as http traffic through this bridge without any problem. 
> The problem is that the ebtables commands which I enter donn seem to 
> work. I have installed Ebtables through source and the commands I 
> entered are:
> #ebtables -P FORWARD DROP
> #ebtables -A FORWARD -p IPv4 -j ACCEPT
> #ebtables -A FORWARD -p ARP -j ACCEPT
> #ebtables -A FORWARD -p Length -j ACCEPT
> #ebtables -A FORWARD --log-level 1 --log-prefix "EBFW" --log-ip
> #ebtables -P INPUT DROP
> #ebtables -A INPUT -p IPv4 -j ACCEPT
> #ebtables -A INPUT -p ARP -j ACCEPT
> #ebtables -A INPUT -p Length -j ACCEPT
> #ebtables -A INPUT --log-level 1 --log-prefix "EBFW" --log-ip
> #ebtables -P OUTPUT DROP
> #ebtables -A OUTPUT -p IPv4 -j ACCEPT
> #ebtables -A OUTPUT -p ARP -j ACCEPT
> #ebtables -A OUTPUT -p Length -j ACCEPT
> #ebtables -A OUTPUT --log-level 1 --log-prefix "EBFW" --log-ip 
> --log-arp -j DROP
> The log watcher logs the traffic in syslog, and I am not able to see 
> it. So precisely my questions are:
> 1- In which file can I see the packets logged by ebtables using the 
> above script? I have checked /var/log/messages  and /var/log/dmesg 
> files. There is nothing logged their.
> 2- I have put all the commands directly on the shell. Do you have to 
> write these commands in some other file?
> 3- Through the "ebtables-save" script I can see which commands I 
> entered but when I restart the ebtables service all these commands 
> disappear. How can I save my script?
>
>
> Kamran Arshad
>
> Network Engineer
>
> Signals R&D Establishment Military College Signals.
>
> Adayala Road, Rawalpindi Pakistan
>
> Cell No. +92-333-515-5857
>
> ------------------------------------------------------------------------
> Be a better sports nut! Let your teams follow you with Yahoo Mobile. 
> Try it now. 
> <http://us.rd.yahoo.com/evt=51731/*http://mobile.yahoo.com/sports;_ylt=At9_qDKvtAbMuh1G1SQtBI7ntAcJ> 
>
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> ------------------------------------------------------------------------
>
> _______________________________________________
> Ebtables-user mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/ebtables-user
>   


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/