LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 02-08-2008, 12:28 PM   #1
lsbrasil
LQ Newbie
 
Registered: Nov 2007
Posts: 3

Rep: Reputation: 0
IPTables interface switch (-i ethx) problem w/ bridge-Firewall


Greetings,

I've been using Slackware Linux for Bridge-Firewalls for a long time with the 2.4.xx family and Netfilter up to date.
My problem began when I started using 2.6.xx. Now I'm using 2.6.24, with netfilter POM-ng patches enabled and iptables 1.4.0. Everything works just fine as usual except that my iptables ruleset that includes physical interfaces are not working anymore. I mean, rules like:

0 0 MARK all -- eth0 * 0.0.0.0/0 0.0.0.0/0

If I don't use the interface switch (-i eth0) or just put the logical bridge interface br0, it works just fine. But if I try to use -i eth0 or -i eth1, etc, the rule just never match, even on the filter INPUT chain.

Am I missing something? I re-read the Bridge-Firewalling HOWTO and many other documents, but didn't find anything related to this issue. Should I forget iptables in a bridge-firewall for this porpouse and just begin using ebtables instead?

Thank you all very much and sorry if I didn't put enought information about my problem here. If so, please, just ask me!
 
Old 02-08-2008, 01:32 PM   #2
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
Once you have bridged devices, the packets are marked as associated with that bridge when they hit iptables. You cannot tell which interface they came from. Only at a lower level (eg. ebtables) can you handle that.
 
Old 02-08-2008, 06:40 PM   #3
lsbrasil
LQ Newbie
 
Registered: Nov 2007
Posts: 3

Original Poster
Rep: Reputation: 0
Thanks very much for your fast reply, Matir. But the fact is that with 2.4.xx Kernel, it works perfectly. That's why I'm confused. I still have several 2.4.xx Bridge Firewalls and the ruleset with the -i switch works 100%. Just with the 2.6.xx kernel, it stopped.

Thanks again!

Quote:
Originally Posted by Matir View Post
Once you have bridged devices, the packets are marked as associated with that bridge when they hit iptables. You cannot tell which interface they came from. Only at a lower level (eg. ebtables) can you handle that.
 
Old 02-09-2008, 06:10 AM   #4
lsbrasil
LQ Newbie
 
Registered: Nov 2007
Posts: 3

Original Poster
Rep: Reputation: 0
I just found the answer to my question. Reading a lot of new documentation about bridging I saw that the 2.6.x kernel with the newest netfilter code has a new feature for physical interfaces called "physdev". I have to use it instead of the -i iptables switch.
The Physdev packet matching matches against the physical bridge ports the IP packet arrived on or will leave by. Example:

iptables -A INPUT -p tcp --dport 22 -m physdev --physdev-in eth1 -j ACCEPT

Thank you very much and I hope this thread can help other administrators with the same issue.
 
  


Reply

Tags
bridge, bridging, firewall, interface, iptables, linux, slackware, switch


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Mandrake Firewall web interface login problem someone_162 Mandriva 2 10-05-2005 06:07 PM
Bridge and network switch ToothlessRebel Linux - Networking 5 01-07-2005 03:03 AM
Bridge/Firewall Connection Problem jhp Linux - Networking 0 10-15-2004 06:07 AM
why do an interface bridge? e1000 Linux - Networking 2 01-06-2004 08:26 AM
How to load ethx, firewall and MASQ on boot?! Tekime Linux - Networking 2 02-18-2002 10:42 AM


All times are GMT -5. The time now is 08:30 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration