Re: bridge filtering help required

Yes I also found that by using ebtables, i can do filtering on bridge level,
 
I have downloaded the ebtables from http://ebtables.sourceforge.net but when i run the ebtables command like ebtables -L , it says 
"cant locate module ebtables, The kernel doesnt support the ebtables 'filter' table"
How can I setup support on kernel for ebtables module? howto install ebtables properly? I dont have any prior experience in setting kernel .

 
Regards, 

SYED JAHANZAIB

 


Date: Wed, 2 Jan 2008 09:10:06 -0800From: swervinswervout-/[email protected]: RE: [Ebtables-user] bridge filtering help requiredTo: [email protected]:  Here is what I suggest. First, I would like to make sure that the terminology is correct. You are associating a user to a MAC. I presume every user gets assigned one computer and does not use any other computer, Otherwise your setup would not work. There is no dynamic User to MAC assignment only MAC to IP assignment (ie. DHCP) correct?Second since you have bridged the two subnets and you want to manipulate traffic through that bridge you are going to have to use ebtables to accomplish that. Once you install ebtables you can then specify which MAC address you want to allow through the bridge or not. It is a simple matter of writing a script that adds and deletes rules in the ebtable INPUT chain. so the command you would use is of this sort.ebtables -A INPUT -s source_mac -j DROPI would try one on the bridge first, if it works you can probably use a specification to read the MAC address from a list of mac addresses with the --among-src option.Let me know if you need anything else."AA Inter.Network Services / SYED JAHANZAiB" <[email protected]> wrote: 


Dear, The scenario is, I am running internet cable service. My objective is to create a firewall bridge between users and server end. this firewall should be transparently filter the traffic between users and server. I want that only specific allowed MAC (ACL) address should pass through bridge to server. there should be a text file containing the allowed mac address. I have created the bridge and assign an ip address to it 10.0.1.1, and its working fine, but its not able to stop users means no filtering is appliying on bridge. I have used the iptables but its not blocking any user. If I block any user, its ping to BRIDGE IP 10.0.1.1 is stopped, but the user is able to pass through bridge and able to contact the server which is behind the bridge. Secondly, I want to setup a DHCP server on the same machine, but only allowed mac should be able to get the ip, and there should be an MAC TO IP MATCH system, means only specific MAC should get the specific ip, if user changes the ip or mac, he shouldnt be able to pass through. there should be a single text file which contains the allowed mac address and ip entries so that I can use it easily.  Regards, SYED JAHANZAIBwww.aacablenet.org/[email protected] 
 


Date: Tue, 1 Jan 2008 14:21:04 -0800From: swervinswervout-/[email protected]: Re: [Ebtables-user] bridge filtering help requiredTo: [email protected]:I am not an expert on iptables, ebtables and netfilters but I will try and see if I can help. First I think you should be able to block communication from one pc to another through iptables but I don't think you can do it only through iptables. Of course it all depends on the configuration. So, I am going to ask for your specific configuration and how (commands used) you have setup the bridge and interfaces. Basically, I believe, if you have setup a bridge and you want to manipulate traffic going from one end to another you have to use ebtables to perform that (either use ebtables to pass on the traffic to iptables or perform the manipulation using ebtables itself).  In your case if you are using MAC address it makes sense to just use ebtables to block the traffic without having to do an extra step to go to iptables. So, if you can give me a listing of your configuration I may be able to better help. If any thing I have said doesn't make sense to you. Let me know and I will see if I can explain it better.Yours "AA Inter.Network Services / SYED JAHANZAiB" <[email protected]> wrote: 


Hi,I have setup bridge on linux (rhat,v9). I want to filter users base on there mac address, but users are not blocking, they are still able to pass through brighe to access other pcs (behind the bridge), I am using IPTABLES to block users,  Am i missing anything ?Do I have to setup something else more?
 Regards, 

SYED JAHANZAIB
 

i’m is proud to present Cause Effect, a series about real people making a difference. Learn more-------------------------------------------------------------------------This SF.net email is sponsored by: MicrosoftDefy all challenges. Microsoft(R) Visual Studio 2005.http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________Ebtables-user mailing listEbtables-user-5NWGOfrQmneRv+LV9MX5ugtCRVl27V+i0wdF1cv0I5s@public.gmane.org://lists.sourceforge.net/lists/listinfo/ebtables-user

Looking for last minute shopping deals? Find them fast with Yahoo! Search.

Don't get caught with egg on your face. Play Chicktionary! Check it out!


Never miss a thing. Make Yahoo your homepage. 
_________________________________________________________________
Get the power of Windows + Web with the new Windows Live.
http://www.windowslive.com?ocid=TXT_TAGHM_Wave2_powerofwindows_122007

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
Ebtables-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ebtables-user