Re: BRIDGE HELP

On 01/10/08 23:50, AA Inter.Network Services / SYED JAHANZAiB wrote:
> Thx for the help. It worked fine.

You are welcome.

> now before moving to advance mode, I would like to describe the scenario.

Ok...

> I am running internet cable.net setup in my local area with around 100+ 
> users. I am filtering users by there MAC Address. some smart users spoof 
> the mac address of working users. I want that this Bridge should also 
> act as a DHCP server too with MAC to IP MATCH binding, so that only 
> specific mac should get the specific ip address, and if the user tries 
> to change the ip or mac, he should get DENY. All other unknown clients 
> shouldn't get any ip or some fake ip with fake gateway.

You can easily set up EBTables to match based on MAC and IP address.
However, this will probably not provide the security that you are
wanting.  If people can spoof MAC addresses, they can equally as well
spoof IP addresses.  Further, if they spoof their MAC address and then
DHCP, they will get the correct IP (reserved) IP address for said MAC.
Note:  That is presuming that the same IP address is used for the MAC
all the time via a DHCP reserved address.  This of course does nothing
for the issue of having duplicate MAC and / or IP addresses on your network.

If you really do want to use such (simple) security measures, I'd
recommend that you *NOT* reserve an IP address for a MAC address, but
rather set up the DHCP server such that the IP address changes, thus
making a moving target for your rogue users to have to find.  To do
this, you would have to incorporate the DHCP servers MAC to IP address
correlation in to your EBTables firewall.  I suppose you could run your
DHCP server on your EBTables firewall and do the integration that way
too.  (I'll have to think on the best way to do the integration
presuming that the services are on the same system.)

Something you may want to consider doing is to augment your EBTables
firewall such that DHCP requests and replies are passed through your
EBTables firewall for everyone and then only filter non DHCP traffic.
In other words, if the frames are DHCP traffic allow them through prior
to starting your existing filter.  Also, if you move your existing
(client) MAC EBTables rules to a sub chain and jump to it, you could
fairly easily dynamically re-generate it on the fly as need be.  Thus
you could fairly easily have something flush a chain and rebuild it
based on known good MAC / IP addresses with out interfering with the
rest of your EBTables firewall.

> More importantly, how can this be done in simple way, because I have to 
> allow/modify/deny various users on daily basis, so is there a way I can 
> edit any single file lets say /etc/macallowed , and there entries should 
> be like,

I would recommend that you not reserve IP addresses for known good MAC
addresses.  Rather I would have a list (file / table in a database /
what ever) of known good MAC addresses and use that to dynamically
re-configure part of your DHCP server as to what MAC addresses it should
hand out (valid) IP addresses to.  Then have a process (the DHCP
server?) modify the EBTables MAC to IP (sub)chain with the MAC and IP
address of the (successfully) registered clients.

Any MAC addresses that are not known to be good can either be given an
IP address in a sand box that will only allow them to get to a sign up
page (or what ever else you want).

> 00-08-74-4D-74-DE   10.0.0.2  # John B-303 Sunview Appartments
> 00-02-74-D2-74-F3   10.0.0.3  # Arnold 402 Aone Bunglows
> And so on . . .

*nod*  With the exception of wanting a moving target IP for known good
MAC addresses, we are on the same page.

> how can I tell ebtables to read from the specific file ? and how to 
> setup entries in DHCP ? Can this be done via editing single file ?

I would not tell EBTables to read from a file per say.  Rather I would
create a sub-chain that I would flush and dynamically re-populate as
need be.  I.e. run a script that will read a list of MAC and IP
addresses and have it dynamically (re)populate the sub-chain with
current / correct information.

I'm not sure what DHCP server you are using, or if it is possible to do
so, but if you can get your DHCP server to run a process upon successful
  lease / renew / release cycles, you could have it initiate the changes
to EBTables for you.  Just food for thought.



Grant. . . .


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace