[lkml]   [1998]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Bridge+firewall - possible?
> After I got everything set up, I found out that Linux bridging layer
> does not go through the packet filter. That makes sense... it's
> ethernet vs IP layers.
> My question -- is there any way to set up a packet-filtering bridge
> using Linux? (including coding)

Ok there are two ways to do this

1. You set up a big proxy arp table and actually route it. Thats the
sledgehammer approach but should work fine providing peopel dont
move PCs around (bonus points for writing a listening daemon
that learns where people are and adjusts the proxy arp table)

2. You use the bridging code. You add a pair of calls to the firewall
hooks for something like 'AF_UNSPEC' and you hack a version of the
IP firewall code into an IP/Mac combination firewall. You'll get
packets with skb->data pointing at the mac level, skb->dev giving
the device and skb->dev->type telling you the device type if you
want to try more than ethernet support


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:46    [W:0.059 / U:5.536 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site