Re: Howto tell EBTABLES to Read from the FILE
AA Inter.Network Services / SYED JAHANZAiB <[email protected]> Thu, 24 Jan 2008 10:28:03 +0000
| Newsgroups | gmane.linux.network.bridge.ebtables.user |
|---|---|
| Message-ID | <[email protected]> |
--===============1601166929==
Content-Type: multipart/alternative;
boundary="_7477a139-1dd2-4267-ba52-f89dfb1bf01e_"
--_7477a139-1dd2-4267-ba52-f89dfb1bf01e_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hello Everyone,
=20
I need a littile help. I am using linux bridge for filtering mac address na=
d mac to ip binding.=20
=20
USERS--> Linux wid Dhcp / mac ip filtering --> isa.SERVER
=20
One problem i m facing after implementing bridge is users internet is not w=
orking on auto detect settings, users have default gateway and dns pointing=
to ISA SERVER, but net is not working on auto settings, instead user have =
to setup proxy setting in there browser to make it work. when i flush all i=
ptables rules, auto detect settings works, i have tried hashing many rules =
in security file, but unable to make it work, kindly take a look at my secu=
rity firewall script.
=20
******* SECURE.SH *************
#!/bin/shIPT=3D"/sbin/iptables"DHCP_SERVER=3D"10.0.8.1"FILE=3D`cat path | a=
wk '/FINAL_FILE/' | cut -d"=3D" -f2`
LOOPBACK=3D"lo"
$IPT -F$IPT -X$IPT -t nat -F$IPT -t nat -X$IPT -t mangle -F$IPT -t mangle -=
X
# edited by zaib to remove request time out delay while implementing securi=
ty $IPT -P INPUT ACCEPT$IPT -P FORWARD ACCEPT$IPT -P OUTPUT ACCEPT# editing=
finished.
cat $FILE | while read MACSdoIP=3D`echo $MACS | awk '{print $2}'`MAC=3D`ech=
o $MACS | awk '{print $1}'`$IPT -t mangle -A PREROUTING -s $IP -m mac --mac=
-source $MAC -j MARK --set-mark 1done
# Accepting DHCP Request$IPT -A INPUT -p udp -s $DHCP_SERVER --sport 67 -d =
255.255.255.255 --dport 68 -j ACCEPT$IPT -A OUTPUT -p udp -s 255.255.255.25=
5 --sport 68 -d $DHCP_SERVER --dport 67 -j ACCEPT
=20
$IPT -A INPUT -i $LOOPBACK -j ACCEPT$IPT -A OUTPUT -o $LOOPBACK -j ACCEPT
=20
# Allow Marked Packets to be allowed$IPT -A INPUT -m mark --mark 1 -j ACCEP=
T$IPT -A FORWARD -m mark --mark 1 -j ACCEPT
$IPT -A INPUT -m mark ! --mark 1 -j DROP$IPT -A FORWARD -m mark ! --mark 1 =
-j DROP
$IPT -P INPUT DROP$IPT -P FORWARD DROP********** secure.sh finished *******=
*
=20
WHat is missing or wrong?
=20
Regards,=20
SYED JAHANZAIB
_________________________________________________________________
Connect and share in new ways with Windows Live.
http://www.windowslive.com/share.html?ocid=3DTXT_TAGHM_Wave2_sharelife_0120=
08=
--_7477a139-1dd2-4267-ba52-f89dfb1bf01e_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class=3D'hmmessage'>
Hello Everyone,<BR>
<BR>
I need a littile help. I am using linux bridge for filtering mac addre=
ss nad mac to ip binding. <BR>
<BR>
USERS--> Linux wid Dhcp / mac ip filtering --> isa.S=
ERVER<BR>
<BR>
One problem i m facing after implementing bridge is users internet is not w=
orking on auto detect settings, users have default gateway and dns pointing=
to ISA SERVER, but net is not working on auto settings, instead user have =
to setup proxy setting in there browser to make it work. when i flush all i=
ptables rules, auto detect settings works, i have tried hashing many rules =
in security file, but unable to make it work, kindly take a look at my secu=
rity firewall script.<BR>
<BR>
******* SECURE.SH *************<BR>
#!/bin/sh<BR>IPT=3D"/sbin/iptables"<BR>DHCP_SERVER=3D"10.0.8.1"<BR>FILE=3D`=
cat path | awk '/FINAL_FILE/' | cut -d"=3D" -f2`<BR>
LOOPBACK=3D"lo"<BR>
$IPT -F<BR>$IPT -X<BR>$IPT -t nat -F<BR>$IPT -t nat -X<BR>$IPT -t mangle -F=
<BR>$IPT -t mangle -X<BR>
# edited by zaib to remove request time out delay while implementing securi=
ty <BR>$IPT -P INPUT ACCEPT<BR>$IPT -P FORWARD ACCEPT<BR>$IPT -P OUTPUT ACC=
EPT<BR># editing finished.<BR>
cat $FILE | while read MACS<BR>do<BR>IP=3D`echo $MACS | awk '{print $2}'`<B=
R>MAC=3D`echo $MACS | awk '{print $1}'`<BR>$IPT -t mangle -A PREROUTING -s =
$IP -m mac --mac-source $MAC -j MARK --set-mark 1<BR>done<BR>
# Accepting DHCP Request<BR>$IPT -A INPUT -p udp -s $DHCP_SERVER --sport 67=
-d 255.255.255.255 --dport 68 -j ACCEPT<BR>$IPT -A OUTPUT -p udp -s 255.25=
5.255.255 --sport 68 -d $DHCP_SERVER --dport 67 -j ACCEPT<BR>
<BR>
$IPT -A INPUT -i $LOOPBACK -j ACCEPT<BR>$IPT -A OUTPUT -o $LOOPBACK -j ACCE=
PT<BR>
<BR>
# Allow Marked Packets to be allowed<BR>$IPT -A INPUT -m mark --mark 1 -j A=
CCEPT<BR>$IPT -A FORWARD -m mark --mark 1 -j ACCEPT<BR>
$IPT -A INPUT -m mark ! --mark 1 -j DROP<BR>$IPT -A FORWARD -m mark ! --mar=
k 1 -j DROP<BR>
$IPT -P INPUT DROP<BR>$IPT -P FORWARD DROP<BR>********** secure.sh finished=
********<BR>
<BR>
WHat is missing or wrong?<BR><BR>
<DIV>
<BR>
<FONT color=3D#0066ff><STRONG><FONT color=3D#000000>Regards,</FONT> </STRON=
G></FONT><BR>
<DIV><FONT color=3D#0066ff></FONT></DIV>
<DIV><STRONG><FONT color=3D#0033ff>SYED JAHANZAIB</FONT></STRONG></DIV></DI=
V><br /><hr />Connect and share in new ways with Windows Live. <a href=3D'h=
ttp://www.windowslive.com/share.html?ocid=3DTXT_TAGHM_Wave2_sharelife_01200=
8' target=3D'_new'>Get it now!</a></body>
</html>=
--_7477a139-1dd2-4267-ba52-f89dfb1bf01e_--
--===============1601166929==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
--===============1601166929==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Ebtables-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ebtables-user
--===============1601166929==--