lkml.org 
[lkml]   [1998]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: Bridge+firewall - possible?
    Date
    > After I got everything set up, I found out that Linux bridging layer
    > does not go through the packet filter. That makes sense... it's
    > ethernet vs IP layers.
    >
    > My question -- is there any way to set up a packet-filtering bridge
    > using Linux? (including coding)

    Ok there are two ways to do this

    1. You set up a big proxy arp table and actually route it. Thats the
    sledgehammer approach but should work fine providing peopel dont
    move PCs around (bonus points for writing a listening daemon
    that learns where people are and adjusts the proxy arp table)

    2. You use the bridging code. You add a pair of calls to the firewall
    hooks for something like 'AF_UNSPEC' and you hack a version of the
    IP firewall code into an IP/Mac combination firewall. You'll get
    packets with skb->data pointing at the mac level, skb->dev giving
    the device and skb->dev->type telling you the device type if you
    want to try more than ethernet support

    Alan


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:46    [W:0.031 / U:184.044 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site