Re: Dual-Homed/Triple-Subnet Bridge Challenge

Okay, we have liftoff...finally!

I include final script below for anyone that runs into
this or similar issues and many thanks to Grant for
putting me on the right path.

A few observations (benefits of hindsight)...

1. When testing brctl commands and ebtables rules from
   the command line, don't forget to:

   A. Flush existing rules (where applicable)
      use: ebtables -t <table> -F

   B. Flush ARP caches on all relevant hosts between tests
      For DOS/Windows clients use: arp -d *
      For Linux clients use: arp -d <IP Address>
      Anyone know a Linux command to flush all entries????

   Because I did not do this myself, some of my earlier
   observations on this thread were incorrect!!

2. When you get final script working, it is a good idea to
   cleanly reboot all affected hosts, including the bridge
   system itself, and test script again to be doubly sure

3. Ubuntu Dapper stock bridge-utils and ebtables packages
   are fine! No need to build custom packages

4. Grant's assertion that you can bind eth0 and eth1
   interfaces before bridging is correct!!!
   i.e. it is not correct to state that you must execute
        the following sequence before bridging:
          # ifconfig eth0 0.0.0.0
          # ifconfig eth1 0.0.0.0
        (this advice often appears on bridge docs)

5. Initial rules proposed by Grant needed tweaking to:
  
   A. Allow Zeroconf ARP (not just IP) traffic through bridge
   B. Broute IP and ARP traffic on home networks

6. You can set up ebtables rules BEFORE setting up bridge

   This is a good idea in my case as it prevents spurious
   packets crossing networks just after bridge is created
   but before rules have been applied

And here is the final script to achieve my ends....  

#!/bin/sh

#######################################################
# Dual-Homed Imaging Server Bridge Configuration Script
# -----------------------------------------------------
# by RVJ Callanan
# with help from [email protected]
#
# Allows operation with Zeroconf imaging clients
# on either or both subnets (in absence of DHCP server)
#
# Assumes server already configured for home networks:
# eth0 on 192.168.3.13 netmask 255.255.255.0
# eth1 on 192.168.4.13 netmask 255.255.255.0
#
# After execution:
# bri0 bridges eth0 and eth1 for Zeroconf traffic only
# bri0 on 169.254.0.13 netmask 255.255.0.0
#######################################################

# Set up rules first so that no spurious packets will
# pass between networks just after bridge is enabled

# BROUTE rules (DROP means ROUTE instead of BRIDGE)

ebtables -t broute -A BROUTING -p ipv4 -i eth0 --ip-src 192.168.3.0/8 -j
DROP
ebtables -t broute -A BROUTING -p ipv4 -i eth0 --ip-dst 192.168.3.0/8 -j
DROP

ebtables -t broute -A BROUTING -p ipv4 -i eth1 --ip-src 192.168.4.0/8 -j
DROP
ebtables -t broute -A BROUTING -p ipv4 -i eth1 --ip-dst 192.168.4.0/8 -j
DROP

ebtables -t broute -A BROUTING -p arp -i eth0 --arp-ip-src 192.168.3.0/8
-j DROP
ebtables -t broute -A BROUTING -p arp -i eth0 --arp-ip-dst 192.168.3.0/8
-j DROP

ebtables -t broute -A BROUTING -p arp -i eth1 --arp-ip-src 192.168.4.0/8
-j DROP
ebtables -t broute -A BROUTING -p arp -i eth1 --arp-ip-dst 192.168.4.0/8
-j DROP

# BRIDGE rules

ebtables -t filter -A FORWARD -p IPv4 --ip-src 169.254.0.0/16 -j ACCEPT
ebtables -t filter -A FORWARD -p IPv4 --ip-dst 169.254.0.0/16 -j ACCEPT

ebtables -t filter -A FORWARD -p arp --arp-ip-src 169.254.0.0/16 -j
ACCEPT
ebtables -t filter -A FORWARD -p arp --arp-ip-dst 169.254.0.0/16 -j
ACCEPT

ebtables -t filter -A FORWARD -j DROP

# Now set up bridge

brctl addbr bri0
brctl addif bri0 eth0
brctl addif bri0 eth1
ifconfig bri0 up
ifconfig bri0 169.254.0.13 netmask 255.255.0.0

# End-of-script


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/