LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 05-01-2006, 11:46 AM   #1
heltendk
LQ Newbie
 
Registered: May 2006
Posts: 2

Rep: Reputation: 0
Forwarding from physical to virtual interface?


Hi!

I have created a virtual network device called im0 by writing a kernel module. The device is not associated to any hardware so in order for it to receive any data, the data must be forwarded from some other device such as eth0 or similar.

I was thinking about using netfilter/iptables to forward ALL traffic recieved at eth0 to im0, but I'm having some problems setting up iptables ;-)

I've read a bunch of guides for iptables, but I guess my scenario is kinda special. Can somebody give some simple iptable rules for forwarding ALL traffic from eth0 to im0?

Thanks!
 
Old 05-02-2006, 09:08 PM   #2
Brian1
LQ Guru
 
Registered: Jan 2003
Location: Seymour, Indiana
Distribution: Distribution: RHEL 5 with Pieces of this and that. Kernel 2.6.23.1, KDE 3.5.8 and KDE 4.0 beta, Plu
Posts: 5,700

Rep: Reputation: 64
Interesting idea. Not sure netfilter iptables can understand im0. I know iptables does not understand alias IP like eth0:0. So one has to use the IP instead of eth0:0 with iptable commands. If you can assign it an IP then that might work. Other thought is maybe you can create it as eth1 or somehow link im0 to eth1.

Brian1
 
Old 05-02-2006, 10:11 PM   #3
vimal
Red Hat India
 
Registered: Nov 2004
Location: Kerala/Pune,india
Distribution: RedHat, Fedora
Posts: 260

Rep: Reputation: 36
Hello heltendk,

I think the proper idea to make 'im0' work is to create a virtual adapter 'eth0:0' and then link it to 'im0'. After that you can use the NAT feature of iptables to forward the traffic destined for 'eth0' to 'eth0:0'. For that you can use the following command.

You would need the modules 'iptable_nat' and 'ip_conntrack' for NATing.

# iptables -t nat -A PREROUTING -d 'IP of eth0' -p tcp -j DNAT --to 'IP of eth0:0'

If you are specific on the data coming in onto a port, then you can use the '-d' switch and specify the port number.

I hope this clarifies your problem. Please reply if anything interesting happens.

Thanks....

Last edited by vimal; 05-02-2006 at 10:44 PM.
 
Old 05-11-2006, 09:29 AM   #4
heltendk
LQ Newbie
 
Registered: May 2006
Posts: 2

Original Poster
Rep: Reputation: 0
Thanks for your replies!

I had to take another approach, since virtual devices have problems receiveing packets :-P Devices associated to some hardware receives an interrupt when data is available.

Instead I created a hook to netfilter from my virtual device, so that each time a packet enters the kernel, I can steal it and modify it, so it appears to originate from the virtual device (im0).

I need to steal packets from multiple devices (wlan0, bsl0, ...) and it actually works quite well now :-)
 
Old 10-09-2006, 12:11 AM   #5
hi_bears
LQ Newbie
 
Registered: Sep 2006
Posts: 4

Rep: Reputation: 0
Quote:
Originally Posted by heltendk
Thanks for your replies!

I had to take another approach, since virtual devices have problems receiveing packets :-P Devices associated to some hardware receives an interrupt when data is available.

Instead I created a hook to netfilter from my virtual device, so that each time a packet enters the kernel, I can steal it and modify it, so it appears to originate from the virtual device (im0).

I need to steal packets from multiple devices (wlan0, bsl0, ...) and it actually works quite well now :-)
is it possbible to let me know how to modify those packets?
i have tried many times but no luck. even ping didn't work...


something happened but i dont know why, e.g.
sb_new -> protocol = eth_type_trans(sb_new, vii_dev), the return is 43200 !!! etc...
thanks in advanced....
 
Old 10-09-2006, 12:22 AM   #6
hi_bears
LQ Newbie
 
Registered: Sep 2006
Posts: 4

Rep: Reputation: 0
Quote:
Originally Posted by heltendk
Thanks for your replies!

I had to take another approach, since virtual devices have problems receiveing packets :-P Devices associated to some hardware receives an interrupt when data is available.

Instead I created a hook to netfilter from my virtual device, so that each time a packet enters the kernel, I can steal it and modify it, so it appears to originate from the virtual device (im0).

I need to steal packets from multiple devices (wlan0, bsl0, ...) and it actually works quite well now :-)
i have been trying to write a virtual interface like yours but no luck. what i did is
(1) get the packet from netfilter. simply use the hook_func
(2) make a copy of the coming sk_buff to a new sk_buff sb_new(sb is the skbuff from the netfilter). using dev_alloc_skb, memcpy( skb_put(sb_new,sb->len), sb->data,sb->len),assign dev( the virtual interface name), and eth_type_trans(sb_new, virtual_interface_name). but it does't work!!!


i am so frustrated.

could you please help me to figure out where is the problem. it would be a great help if you can give me part of your code.

thank you so much.
 
Old 10-09-2006, 11:28 PM   #7
hi_bears
LQ Newbie
 
Registered: Sep 2006
Posts: 4

Rep: Reputation: 0
Quote:
Originally Posted by hi_bears
i have been trying to write a virtual interface like yours but no luck. what i did is
(1) get the packet from netfilter. simply use the hook_func
(2) make a copy of the coming sk_buff to a new sk_buff sb_new(sb is the skbuff from the netfilter). using dev_alloc_skb, memcpy( skb_put(sb_new,sb->len), sb->data,sb->len),assign dev( the virtual interface name), and eth_type_trans(sb_new, virtual_interface_name). but it does't work!!!


i am so frustrated.

could you please help me to figure out where is the problem. it would be a great help if you can give me part of your code.

thank you so much.
seems problem solved, not 100% sure yet. the key point is the rebuild of the header. and even eth_type_trans returns a weird value, it still works... under investigation...
 
Old 10-10-2006, 09:22 PM   #8
hi_bears
LQ Newbie
 
Registered: Sep 2006
Posts: 4

Rep: Reputation: 0
Quote:
Originally Posted by hi_bears
seems problem solved, not 100% sure yet. the key point is the rebuild of the header. and even eth_type_trans returns a weird value, it still works... under investigation...
it turned out the statement above is not correct.........
i have made sure all addresses are correct, and i have printed out all of them, it should works. BUT, it doesn't. the computer became very slow and it seems it is doning something inside and eats up most of the CPU time. don't know the reason. who knows any hint. please drop me one or two lines. thank you so much.
 
Old 01-11-2007, 12:22 PM   #9
evidence01
LQ Newbie
 
Registered: Jan 2007
Posts: 1

Rep: Reputation: 0
I have question about your hooking. I have a similar requriement whereby i have a virtual device sitting on top of two physical driers (eth0\1). Now the system is running in bridged mode whereby i want the bridge to attach to my virtual adapters (a, b) which are in turn attached to the physcial drivers for transmission. I dont want the brdige to even know about the real eth0/1. Ive been looking deep into the kernel code and it seems i have a similar issue as yourself. How can i force packets coming inbound from eth0/1 to be forwarded to my virtual adapters, so that the brdige functoins properly in tx/rx directions? I was thinking of using:

.hook = function,
87 .owner = THIS_MODULE,
88 .pf = PF_BRIDGE,
89 .hooknum = NF_BR_BROUTING ,
90 .priority = NF_BR_PRI_FIRST,

which is a nice hook that can intercept packets before they reach the bridge ports. However looking at dev.c netif_receive_skb() it seems the bridge will always get a packet before any netfilter hook, however inside the bridge frame handling code it will actually process all items in NF_BR_BROUTING chain first, so i can intercept it there and do whatever i need.

I was also thinking of using the divert_frame function which can essentially process a skb before it even reaches the bridge but it seems to not offer any substantial advantages.

All in all, these solutions allow me to hook it and see the skb, and what i need even before my bridge sees it but my problem is a little bit different. I just want have all tx/rx traffic go through my virtual interfaces because of the special conditions a bridge poses. ; namely the bridge requires its slave interfaces to do both tx/rx and attaching strictly tx virtual if(s) to the bridge handles tx fine, however the rx is another story. All packets arriving on the physical boards seem to enter a black hole because they have nowhere to go (there is no ip routing whatsoever due to a bridge setup, none of the physical and virtual ifs have ip addresses, there is only the bridge).

Too much rambling, but can you offer some insight into a good solution for having virtual adapters "masking" the physical adapters from a bridge so that i can shape traffic in all directions on the bridged host from both NIC cards via my virtual adapters while hidhing the presence of the eth0/1 completely from the bridge.


Thanks

Jay
 
  


Reply

Tags
network, virtual device


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Port/Address forwarding with iptables with one network interface. Nextrastus Linux - Networking 5 09-18-2013 10:55 AM
ssh forwarding : bind to a specific interface flupke Linux - Networking 9 12-09-2011 06:24 PM
API for mapping Physical Address to Virtual Address Lakshman_smt Linux - Software 2 10-15-2006 10:08 PM
Virtual hosts and port forwarding fr_laz Linux - Networking 0 02-03-2005 03:46 PM
eth0 interface stops forwarding geustace Linux - Networking 4 03-09-2004 02:28 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 02:25 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration