lkml.org 
[lkml]   [1998]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Bridge+firewall - possible?
Date
> After I got everything set up, I found out that Linux bridging layer
> does not go through the packet filter. That makes sense... it's
> ethernet vs IP layers.
>
> My question -- is there any way to set up a packet-filtering bridge
> using Linux? (including coding)

Ok there are two ways to do this

1. You set up a big proxy arp table and actually route it. Thats the
sledgehammer approach but should work fine providing peopel dont
move PCs around (bonus points for writing a listening daemon
that learns where people are and adjusts the proxy arp table)

2. You use the bridging code. You add a pair of calls to the firewall
hooks for something like 'AF_UNSPEC' and you hack a version of the
IP firewall code into an IP/Mac combination firewall. You'll get
packets with skb->data pointing at the mac level, skb->dev giving
the device and skb->dev->type telling you the device type if you
want to try more than ethernet support

Alan


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:46    [from the cache]
©2003-2011 Jasper Spaans. Advertise on this site