Can't access bridge from one interface
"Phil Hopkins" <phopkins-6jNv/[email protected]>
| Newsgroups | gmane.linux.network.bridge.ebtables.user |
|---|---|
| Message-ID | <[email protected]> |
I am using ebtables on two Debian Sarge systems - kernel 2.6.11-smp, I have an ip assigned to the bridge interface. On one of them everything works fine, on the second I can only access the system from one ethernet interface and not from the other. My setup code is: (very ugle and borrowed!) any suggestions would be appreciated. BRIDGE_IP="192.168.39.5" BRIDGE_IFACE="br0" INTL_ADDR_RANGE="192.168.39.0/24" EXTNET_IFACE="eth1" LAN_IFACE="eth0" LOOP_IFACE="lo" LOOP_IP="127.0.0.1" IPTABLES="/sbin/iptables" ifconfig $EXTNET_IFACE 0.0.0.0 ifconfig $LAN_IFACE 0.0.0.0 $IPTABLES -F $IPTABLES -X $IPTABLES -Z $IPTABLES -P INPUT ACCEPT $IPTABLES -P OUTPUT ACCEPT $IPTABLES -P FORWARD ACCEPT $IPTABLES -t mangle -P PREROUTING ACCEPT ifconfig $BRIDGE_IFACE down brctl delbr $BRIDGE_IFACE brctl addbr $BRIDGE_IFACE brctl stp $BRIDGE_IFACE off brctl addif $BRIDGE_IFACE $LAN_IFACE brctl addif $BRIDGE_IFACE $EXTNET_IFACE ifconfig $BRIDGE_IFACE 192.168.39.5 netmask 255.255.255.0 ifconfig $LAN_IFACE 0.0.0.0 ifconfig $EXTNET_IFACE 0.0.0.0 route del -net 204.71.88.0 netmask 255.255.255.0 dev $LAN_IFACE route add -net 192.168.39.0 netmask 255.255.255.0 dev $BRIDGE_IFACE route del default gateway 204.71.88.1 dev $LAN_IFACE route add default gateway 192.168.39.10 dev $BRIDGE_IFACE echo "1" > /proc/sys/net/ipv4/ip_forward ebtables -P FORWARD DROP ebtables -A FORWARD -p IPv4 -j ACCEPT ebtables -A FORWARD -p ARP -j ACCEPT ebtables -A FORWARD -p LENGTH -j ACCEPT ebtables -A FORWARD --log-level info --log-ip --log-prefix EBFW ebtables -P INPUT DROP ebtables -A INPUT -p IPv4 -j ACCEPT ebtables -A INPUT -p ARP -j ACCEPT ebtables -A INPUT -p LENGTH -j ACCEPT ebtables -A INPUT --log-level info --log-ip --log-prefix EBFW ebtables -P OUTPUT DROP ebtables -A OUTPUT -p IPv4 -j ACCEPT ebtables -A OUTPUT -p ARP -j ACCEPT ebtables -A OUTPUT -p LENGTH -j ACCEPT echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route echo "1" > /proc/sys/net/ipv4/tcp_syncookies