Re: Dual-Homed/Triple-Subnet Bridge Challenge

On 2/11/2008 3:52 PM, Vincent Callanan wrote:
> Is it possible to create an efficient bridge between 
> eth0:0 and eth1 for 169.254.*.* traffic only, while 
> giving my server applications visibility of all three 
> subnets?

Let's set efficiency aside for a few moments and concentrate on whether 
or not what you want to do is possible.

I must ask, why not bind the 169.254.x.y/16 subnet to the eth1:0 interface?

Note that aliased interfaces are usually not ""real interfaces in such 
as they do not appear as an interface that can be used in routing and / 
or firewalling / filtering.  As such, you are effectively dealing with 
the real unaliased interface.

You can build a bridge between eth0 and eth1 and use EBTables to control 
what is and what is not bridged between the two interfaces.

Are you planing on having the eth1 network having multiple subnets on 
it, i.e. the 169.254/16 subnet, or will devices on the 192.168.4/24 
network route via 192.168.4.13 to get to the 169.254/16 subnet?

For the sake of discussion I'm going to presume that you will not be 
routing the 169.254/16 subnet and that devices will be directly 
connected to eth1.

Build a bridge containing eth0 and eth1 and use EBTables to filter 
traffic that is bridged based on the source / destination IP address. 
For example:

ebtables -t filter -A FORWARD -s 169.254.0.0/16 -j ACCEPT
ebtables -t filter -A FORWARD -d 169.254.0.0/16 -j ACCEPT
ebtables -t filter -A FORWARD -j DROP

Seeing as how the only use of the bridge (as I see it) is to bridge the 
169.254/16 traffic, you can and should have the bridge block (DROP) all 
other traffic.  Your services will still be bound to the eth0 and eth1 
interfaces, thus not being dependent on the bridge.

I'd suggest that you not have IPTables see your bridged traffic unless 
you have a specific reason to do so.  Use EBTables to do your filtering.

One thing to keep in mind with this bridge is that you will have some 
ARP broadcasts that are common that you may what to filter out.

> If this is indeed possible, will server performance 
> be seriously degraded by non-169.254.*.* traffic on 
> either interface?

Unless you are talking about millions of packets, I don't think you will 
have a problem.

> TIA,

You are welcome.



Grant. . . .

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/