Help with an ebtables setup!!
"Ramsurrun Visham" <[email protected]> Fri, 14 Dec 2007 13:18:46 +0400
| Newsgroups | gmane.linux.network.bridge.ebtables.user |
|---|---|
| Message-ID | <[email protected]> |
Hi to all, I badly require some help with an ebtables setup of mine.. I have 4 PCs connected directly to a switch..2 are end-user hosts (A and B) and two are filtering firewalls (FW_1 and FW_2). A & B have IP addresses assigned to them while FW_1 & FW_2 don't. All the eth0 interfaces are connected to the switch. The lbdnat target that I use is one that I have written for performing load balancing to two mac addresses. It is based on the dnat target. Hence it works just the same. The configurations of each are given in the file myScripts.txt The problems i'm facing are as follows: The ping requests get load balanced to FW_1 and FW_2 but the packets dont get checked against the iptables rules. I see the counter of the IPTables' FORWARD chain remain zero while its OUTPUT and INPUT counters increase. I dont know why this happens. Sometimes the setup works, sometimes it doesnt. Also, when i want packets to go from A onto the firewall nodes (FW_1 and FW_2) and then out through the eth1 interface to some router, what rules do I use? Any help will be really great.. Warm regards, Visham ------------------------------------------------------------------------- SF.Net email is sponsored by: Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace _______________________________________________ Ebtables-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ebtables-user
myScripts.txt
(text/plain, 2.5 KB)
############Host A (IP = 192.168.10.2 ; MAC: 00:14:85:12:d4:6c)############### #!/bin/bash brctl addbr br0 brctl stp br0 off brctl addif br0 eth0 ifconfig br0 0.0.0.0 ifconfig eth0 0.0.0.0 down ifconfig br0 192.168.10.2 netmask 255.255.255.0 broadcast 192.168.10.255 ifconfig br0 up ifconfig eth0 up ebtables -t nat -A OUTPUT -o eth0 -p arp --arp-opcode Request -j lbdnat --to-lbdst 00:0f:3d:cd:b8:3d,00:30:f1:25:fc:52 ebtables -t nat -A OUTPUT -o eth0 -p ipv4 -j lbdnat --to-lbdst 00:0f:3d:cd:b8:3d,00:30:f1:25:fc:52 ip route add 192.168.10.0/24 dev br0 ############Host B (IP = 192.168.10.10 ; MAC: 00:0f:b0:df:10:8c)############### #!/bin/bash brctl addbr br0 brctl stp br0 off brctl addif br0 eth0 ifconfig br0 0.0.0.0 ifconfig eth0 0.0.0.0 down ifconfig br0 192.168.10.10 netmask 255.255.255.0 broadcast 192.168.10.255 ifconfig br0 up ifconfig eth0 up ebtables -t nat -A OUTPUT -o eth0 -p arp --arp-opcode Request -j lbdnat --to-lbdst 00:0f:3d:cd:b8:3d,00:30:f1:25:fc:52 ebtables -t nat -A OUTPUT -o eth0 -p ipv4 -j lbdnat --to-lbdst 00:0f:3d:cd:b8:3d,00:30:f1:25:fc:52 ip route add 192.168.10.0/24 dev br0 ############FW_1 (no IP ; MAC: 00:30:f1:25:fc:52)############### #!/bin/bash brctl addbr br0 brctl stp br0 off brctl addif br0 eth0 brctl addif br0 eth1 ifconfig br0 0.0.0.0 ifconfig eth0 0.0.0.0 down ifconfig eth1 0.0.0.0 down ifconfig br0 up ifconfig eth0 up ifconfig eth1 up ebtables -t nat -A PREROUTING -p arp --arp-mac-src ! 00:0f:3d:cd:b8:3d --arp-opcode Request -j arpreply --arpreply-mac 00:30:f1:25:fc:52 iptables -F iptables -X iptables -Z iptables -A FORWARD -m physdev --physdev-in eth0 --physdev-out eth0 -s 192.168.10.0/24 -d 192.168.10.0/24 -j ACCEPT iptables -A FORWARD -m physdev --physdev-is-bridged -s 192.168.10.0/24 -d 192.168.10.0/24 -j ACCEPT ip route flush all ip route add 192.168.10.0/24 dev br0 ############FW_2 (no IP ; MAC: 00:0f:3d:cd:b8:3d)############### #!/bin/bash brctl addbr br0 brctl stp br0 off brctl addif br0 eth0 brctl addif br0 eth1 ifconfig br0 0.0.0.0 ifconfig eth0 0.0.0.0 down ifconfig eth1 0.0.0.0 down ifconfig br0 up ifconfig eth0 up ifconfig eth1 up ebtables -t nat -A PREROUTING -p arp --arp-mac-src ! 00:30:f1:25:fc:52 --arp-opcode Request -j arpreply --arpreply-mac 00:0f:3d:cd:b8:3d iptables -F iptables -X iptables -Z iptables -A FORWARD -m physdev --physdev-in eth0 --physdev-out eth0 -s 192.168.10.0/24 -d 192.168.10.0/24 -j ACCEPT iptables -A FORWARD -m physdev --physdev-is-bridged -s 192.168.10.0/24 -d 192.168.10.0/24 -j ACCEPT ip route flush all ip route add 192.168.10.0/24 dev br0