802.1Q + Briding + one NIC (or one LAN)

Hello,

First let me say THANKS! for all the work you all put into Ebtables !
(This is my first post here.)

I'm trying to set up ethernet bridging and vlan trucking with Cisco Catalyst 
2950 switch in a way which must not be normal, and is giving me trouble.

First of all, bridging and vlan trucking are working great when connected in 
a normal way.

Here's what I'm trying to do:

I have a largish flat network (All connected with switches, some of which 
are manageable and the rest of which aren't.)
(About a hundred computers or so.)
(The network is also spread out over several geographical locations)

dmesg says:
Dead loop on virtual device vlan10, fix it urgently!
printk: 24467 messages suppressed.



I wish to transparently firewall a bunch of these workstations so that only 
traffic TO a given workstation will be sent to it, and only traffic FROM a 
given workstation will be allowed to be sent from it. (Based on IP.)

This does two things: It prevents all unneeded arp who-has broadcasts from 
hitting every workstation, and more importantly, it prevents the 
workstations from spoofing IPs and/or causing IP conflict with anybody else.

I also need to run non-trunked data over the network.

I envisioned that if I put all workstations which must be firewalled each on 
a port of a catalyst 2950,  on which each port was set to a unique vlan ID, 
I could then set up a linux box to trunk to each of the different vlan IDs. 
Then, using a bridge and ebtables, I could bridge all the vlans together --  
and add rules to ebtables to only allow traffic to and from each vlan as was 
from/to that vlan. (And each vlan would have one workstation on it.)

This all worked using two NICs until I tried to use the same LAN for both 
the trunk and the non trunk.

So here's what I'd hoped would happen (how I thought it would work) 
Workstation 10, which is plugged into port 10 on the Cisco. Port ten on the 
Cisco is the one and only port assigned to vlan 10. The Cisco switch's port 
24 is designated to be the trunk port. The trunk port is plugged into our 
one and only LAN. The Linux box, with one network card, is also plugged into 
the one and only LAN, and has a bridge br0 who's IP is 10.0.0.155 and who 
has as slaves eth0 and vlan10 (eth0 and vlan10 not having any IP of their 
own.)

The workstation would send out a packet to 10.0.0.1. The packet would hit 
the Cisco, get trunked on vlan ID 10 down to the linux box, come in on 
interface (Via eth0) vlan10(which is in a bridge with eth0), go through 
ebtables rules, then on back out eth0 to 10.0.0.1 as a normal (non trunked) 
packet.

Here's the commands I typed:

ifconfig eth0 0 up
brctl addbr br0
brctl addif eth0
ifconfig br0 10.0.0.155
vconfig add br0 10
brctl addif vlan10

ebtables -P FORWARD DROP

Then I start getting from dmesg:
Dead loop on virtual device vlan10, fix it urgently!
printk: 24467 messages suppressed.

I also tried same thing except vconfig add eth0 10 instead of add br0 10. 
That didn't work either. I don't think it did any dead loops, it just didn't 
work. Was the bridge somehow snarfing up the trunk data?

I even tried using two NICs (but one LAN) like this:

ifconfig eth0 0 up
ifconfig eth1 0 up
brctl addbr br0
brctl addif eth0
vconfig add eth1 10
brctl addif br0 vlan10
ifconfig br0 10.0.0.155

Then I connected both eth0 and eth1 into the same cheap switch (and thereby 
into the rest of the LAN.)
This time I got in dmesg:
eth0: received packet with  own address as source address

(And a flood of looping packets I suspect.)

Using two NICs and bridging two separate lans works great -- but that's not 
what I'm trying to do.

Thanks very much,

-Jesse Gordon

Nikola Engineering Inc.
224 W. Washington St.
Suite 104
Sequim, WA 98382-3371
Tel  (360)582-1051
Fax (360)582-1104





-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf