[lkml]   [1998]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Bridge+firewall - possible?
    > After I got everything set up, I found out that Linux bridging layer
    > does not go through the packet filter. That makes sense... it's
    > ethernet vs IP layers.
    > My question -- is there any way to set up a packet-filtering bridge
    > using Linux? (including coding)

    Ok there are two ways to do this

    1. You set up a big proxy arp table and actually route it. Thats the
    sledgehammer approach but should work fine providing peopel dont
    move PCs around (bonus points for writing a listening daemon
    that learns where people are and adjusts the proxy arp table)

    2. You use the bridging code. You add a pair of calls to the firewall
    hooks for something like 'AF_UNSPEC' and you hack a version of the
    IP firewall code into an IP/Mac combination firewall. You'll get
    packets with skb->data pointing at the mac level, skb->dev giving
    the device and skb->dev->type telling you the device type if you
    want to try more than ethernet support


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:46    [W:0.022 / U:1.104 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site