Re: 802.1Q + Briding + one NIC (or one LAN)

Grant: Many thanks for your insightful response.
I was a little confused by your suggestion (last large paragraph.)
Due to my own lack of knowledge, some of your suggestion seemed ambiguous.
I think you were suggestion that I do this:

ifconfig eth0 0
vconfig add eth0 1
vconfig add eth0 2
brctl addbr br0
brctl addif br0 vlan1
brctl addif br0 vlan3

Did I understand correctly?
In theory, this would bridge together vlan3 and vlan1 which we suppose to be 
the same as non-trunked traffic.
(since vlan1 is the default vlan.)

This probably won't work because cisco catalyst 2950 series (and probably 
all cisco) do not allow vlan1 to trunk.

But I'll try that anyway and let you know how it works out.

Of course, this just dawned on me: "I could change all of the ports assigned 
to vlan1 to 10 or something, then use that as my "default" vlan. Then the 
linux box could access the non trunked data through vlan10, and trunks 
through other vlan devices."

(This brings up another problem: It seems that our cat 2950 won't pass 
tagged frames for vlans with which it's not associated. In other words, if 
you're trunking between two cat 2950s, don't ask them to do so while passing 
trunk data through another uninvolved cat 2950...)

> Hmm.  I'm not sure how adding VLAN interfaces on top of a bridge will 
> respond.  I would add it to the raw ether interface.

Everybody:

I did try "vconfig add eth0 3" and it creates a vlan3 but the trunk doesn't 
pass any data.
However, this works:

ifconfig eth0 0
brctl addbr br0
brctl addif eth0
ifconfig br0 10.0.0.155
vconfig add br0 3

That creates a vlan3, and using
ping 10.0.0.4 -I vlan3
I can indeed ping 10.0.0.4 which is plugged into the catalyst 2950 on a port 
assigned to vlan3.
(If I add vlan3 to eth0 I can't ping it if eth0 belongs to a bridge.)

Now so far, this is what I want: To be able to have one NIC in the linux 
box, carrying both the trunked data and non trunked.

But when I then type:
brctl addif br0 vlan3
dmesg fills up with errors about dead loops on virtual device vlan3 -- even 
with nothing plugged into the linux box's NIC.

On another note, I found that one of our cat 2950 series happily allows 
trunked and non trunked data on same port
(The port can be set to trunk, trunk desirable, and static access among 
others) while our other cat 2950 just doesn't allow any non trunked data on 
a port set to trunk (and the settings do not include 'trunk desirable,').
(By Happily, nothing showed up in the log except notices when ports changed 
from up to down and the like.)
(The two switches are slightly different, and most importantly probably have 
different versions of IOS.)

I suspect that the solution to my problem if trunking and vlanning all on 
one LAN lies in ebtables and two NICs.

Doing it with one NIC would be fine, but it may not be possible to prevent 
with ebtables rules that entirely internal "dead loop."

But lets say I have two NICs:

ifconfig eth0 0
brctl addbr br0
brctl addif br0 eth0
ifconfig br0 10.0.0.155
ifconfig eth1 0
vconfig add eth1 3
brctl addif br0 vlan3

Then I could plug both ethernet cards into the same LAN. Of course Linux 
will complain about receiving packets from it's own address. (And packet 
loops could also slow down the network.)

Would it be possible to use ebtables to prevent any trunk packets from 
entering the eth0 non trunk port, and prevent any non trunk packets from 
entering the eth1 trunk port?


Many thanks,

Jesse

Nikola Engineering Inc.
224 W. Washington St.
Suite 104
Sequim, WA 98382-3371
Tel  (360)582-1051
Fax (360)582-1104


----- Original Message ----- 
From: "Grant Taylor" <[email protected]>
To: <[email protected]>
Sent: Wednesday, August 31, 2005 8:35 PM
Subject: Re: [Ebtables-user] 802.1Q + Briding + one NIC (or one LAN)


>> dmesg says:
>> Dead loop on virtual device vlan10, fix it urgently!
>> printk: 24467 messages suppressed.
>>
>> I wish to transparently firewall a bunch of these workstations so that 
>> only traffic TO a given workstation will be sent to it, and only traffic 
>> FROM a given workstation will be allowed to be sent from it. (Based on 
>> IP.)
>
> *nod*  I recently did something similar to this in a sorority that I have 
> as a client.
>
>> I also need to run non-trunked data over the network.
>
> Ok...
>
>> I envisioned that if I put all workstations which must be firewalled each 
>> on a port of a catalyst 2950,  on which each port was set to a unique 
>> vlan ID, I could then set up a linux box to trunk to each of the 
>> different vlan IDs. Then, using a bridge and ebtables, I could bridge all 
>> the vlans together --  and add rules to ebtables to only allow traffic to 
>> and from each vlan as was from/to that vlan. (And each vlan would have 
>> one workstation on it.)
>
> Yes this is doable.
>
>> This all worked using two NICs until I tried to use the same LAN for both 
>> the trunk and the non trunk.
>
> I have a feeling you had a switch that did not like seeing the non trunk 
> traffic on what it thought was a trunk port.  If the switch was expecting 
> tagged trunk traffic and it saw some that was not it could get very upset.
>> So here's what I'd hoped would happen (how I thought it would work) 
>> Workstation 10, which is plugged into port 10 on the Cisco. Port ten on 
>> the Cisco is the one and only port assigned to vlan 10. The Cisco 
>> switch's port 24 is designated to be the trunk port. The trunk port is 
>> plugged into our one and only LAN. The Linux box, with one network card, 
>> is also plugged into the one and only LAN, and has a bridge br0 who's IP 
>> is 10.0.0.155 and who has as slaves eth0 and vlan10 (eth0 and vlan10 not 
>> having any IP of their own.)
>>
>> The workstation would send out a packet to 10.0.0.1. The packet would hit 
>> the Cisco, get trunked on vlan ID 10 down to the linux box, come in on 
>> interface (Via eth0) vlan10(which is in a bridge with eth0), go through 
>> ebtables rules, then on back out eth0 to 10.0.0.1 as a normal (non 
>> trunked) packet.
>
> Ok, this makes sense, save for the fact that I'm not sure how a Cat 2950 
> will react to having trunk and non trunk traffic on the same port.
>
>> Here's the commands I typed:
>>
>> ifconfig eth0 0 up
>> brctl addbr br0
>> brctl addif eth0
>> ifconfig br0 10.0.0.155
>> vconfig add br0 10
>> brctl addif vlan10
>>
>> ebtables -P FORWARD DROP
>>
>> Then I start getting from dmesg:
>> Dead loop on virtual device vlan10, fix it urgently!
>> printk: 24467 messages suppressed.
>
> Hmm.  I'm not sure how adding VLAN interfaces on top of a bridge will 
> respond.  I would add it to the raw ether interface.  (Like you are doing 
> next.)
>
>> I also tried same thing except vconfig add eth0 10 instead of add br0 10. 
>> That didn't work either. I don't think it did any dead loops, it just 
>> didn't work. Was the bridge somehow snarfing up the trunk data?
>
> Check the logs on the 2950 to see if it is happy or if it is upset.
>
>> I even tried using two NICs (but one LAN) like this:
>>
>> ifconfig eth0 0 up
>> ifconfig eth1 0 up
>> brctl addbr br0
>> brctl addif eth0
>> vconfig add eth1 10
>> brctl addif br0 vlan10
>> ifconfig br0 10.0.0.155
>>
>> Then I connected both eth0 and eth1 into the same cheap switch (and 
>> thereby into the rest of the LAN.)
>> This time I got in dmesg:
>> eth0: received packet with  own address as source address
>
> With eth0 being a member of the br0 bridge which will transmit the frames 
> back out the other ports of the bridge the traffic will go back out eth1 
> in to the same switch that eth0 is connected to and could possibly be 
> retransmitted back in to eth0 as a loop.  Again differently so I am sure 
> that I'm stating it correctly.
>
>  -> eth0 -> br0 -> eth1 -> switch ->
> ^                                     v
>  <- <- <- <- <- <- <- <- <- <- <- <-
>
> I don't have a solution to your problem but I can see how things might not 
> work.  I can also tell you what I would try to do.  See if you can't get 
> all your ports to accept both untagged traffic and put them in to one VLAN 
> (VID 1?) and tagged traffic as well.  Then if your switches see tagged 
> traffic they know that it is part of a VLAN and will pass it as is over 
> trunks.  Any untagged traffic will come in as such and be handled 
> internaly as VLAN traffic on it's own VLAN so the traffic will pass over 
> trunks correctly.  When the default VLAN (VID 1?) traffic needs to go out 
> a port that is considered to be a non trunk port send it out untagged but 
> yet allow it to send out tagged traffic.  I think this will let your VLAN 
> aware equipment handle all traffic in a manner that it is aware of.  In 
> this case you would not necessarily be adding eth0 to the bridge but 
> rather vlan1.
>
> Give that a read / try and see what you think.
>
>
>
> Grant. . . .
>
>
> -------------------------------------------------------
> SF.Net email is Sponsored by the Better Software Conference & EXPO
> September 19-22, 2005 * San Francisco, CA * Development Lifecycle 
> Practices
> Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
> Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
> _______________________________________________
> Ebtables-user mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/ebtables-user
> 




-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf