Re: 802.1Q + Briding + one NIC (or one LAN)

> dmesg says:
> Dead loop on virtual device vlan10, fix it urgently!
> printk: 24467 messages suppressed.
> 
> I wish to transparently firewall a bunch of these workstations so that 
> only traffic TO a given workstation will be sent to it, and only traffic 
> FROM a given workstation will be allowed to be sent from it. (Based on IP.)

*nod*  I recently did something similar to this in a sorority that I have as a client.

> I also need to run non-trunked data over the network.

Ok...

> I envisioned that if I put all workstations which must be firewalled 
> each on a port of a catalyst 2950,  on which each port was set to a 
> unique vlan ID, I could then set up a linux box to trunk to each of the 
> different vlan IDs. Then, using a bridge and ebtables, I could bridge 
> all the vlans together --  and add rules to ebtables to only allow 
> traffic to and from each vlan as was from/to that vlan. (And each vlan 
> would have one workstation on it.)

Yes this is doable.

> This all worked using two NICs until I tried to use the same LAN for 
> both the trunk and the non trunk.

I have a feeling you had a switch that did not like seeing the non trunk traffic on what it thought was a trunk port.  If the switch was expecting tagged trunk traffic and it saw some that was not it could get very upset. 

> So here's what I'd hoped would happen (how I thought it would work) 
> Workstation 10, which is plugged into port 10 on the Cisco. Port ten on 
> the Cisco is the one and only port assigned to vlan 10. The Cisco 
> switch's port 24 is designated to be the trunk port. The trunk port is 
> plugged into our one and only LAN. The Linux box, with one network card, 
> is also plugged into the one and only LAN, and has a bridge br0 who's IP 
> is 10.0.0.155 and who has as slaves eth0 and vlan10 (eth0 and vlan10 not 
> having any IP of their own.)
> 
> The workstation would send out a packet to 10.0.0.1. The packet would 
> hit the Cisco, get trunked on vlan ID 10 down to the linux box, come in 
> on interface (Via eth0) vlan10(which is in a bridge with eth0), go 
> through ebtables rules, then on back out eth0 to 10.0.0.1 as a normal 
> (non trunked) packet.

Ok, this makes sense, save for the fact that I'm not sure how a Cat 2950 will react to having trunk and non trunk traffic on the same port.

> Here's the commands I typed:
> 
> ifconfig eth0 0 up
> brctl addbr br0
> brctl addif eth0
> ifconfig br0 10.0.0.155
> vconfig add br0 10
> brctl addif vlan10
> 
> ebtables -P FORWARD DROP
> 
> Then I start getting from dmesg:
> Dead loop on virtual device vlan10, fix it urgently!
> printk: 24467 messages suppressed.

Hmm.  I'm not sure how adding VLAN interfaces on top of a bridge will respond.  I would add it to the raw ether interface.  (Like you are doing next.)

> I also tried same thing except vconfig add eth0 10 instead of add br0 
> 10. That didn't work either. I don't think it did any dead loops, it 
> just didn't work. Was the bridge somehow snarfing up the trunk data?

Check the logs on the 2950 to see if it is happy or if it is upset.

> I even tried using two NICs (but one LAN) like this:
> 
> ifconfig eth0 0 up
> ifconfig eth1 0 up
> brctl addbr br0
> brctl addif eth0
> vconfig add eth1 10
> brctl addif br0 vlan10
> ifconfig br0 10.0.0.155
> 
> Then I connected both eth0 and eth1 into the same cheap switch (and 
> thereby into the rest of the LAN.)
> This time I got in dmesg:
> eth0: received packet with  own address as source address

With eth0 being a member of the br0 bridge which will transmit the frames back out the other ports of the bridge the traffic will go back out eth1 in to the same switch that eth0 is connected to and could possibly be retransmitted back in to eth0 as a loop.  Again differently so I am sure that I'm stating it correctly.

  -> eth0 -> br0 -> eth1 -> switch ->
^                                     v
  <- <- <- <- <- <- <- <- <- <- <- <-

I don't have a solution to your problem but I can see how things might not work.  I can also tell you what I would try to do.  See if you can't get all your ports to accept both untagged traffic and put them in to one VLAN (VID 1?) and tagged traffic as well.  Then if your switches see tagged traffic they know that it is part of a VLAN and will pass it as is over trunks.  Any untagged traffic will come in as such and be handled internaly as VLAN traffic on it's own VLAN so the traffic will pass over trunks correctly.  When the default VLAN (VID 1?) traffic needs to go out a port that is considered to be a non trunk port send it out untagged but yet allow it to send out tagged traffic.  I think this will let your VLAN aware equipment handle all traffic in a manner that it is aware of.  In this case you would not necessarily be adding eth0 to the bridge but rather vlan1.

Give that a read / try and see what you think.



Grant. . . .


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf