| Bridging and firewalling |
| ------------------------ |
| It is possible to use bridging in combination with firewalling. This is |
| a blatant violation of the OSI model, but it's very useful, so we don't |
| care. |
| |
| Assuming you are on a non-stone age kernel (less than 5 years old). |
| You can use the regular iptables firewalling as if you were doing |
| routing. So, rules for forwarding are added to the FORWARD chain, |
| rules for input to the local machine are added to the INPUT chain, |
| etc. Things will work like you expect them to. |
| So a rule like |
| |
| # iptables -A INPUT -i eth0 -j DROP |
| |
| will drop all traffic coming from 'eth0', even if the interface the packets |
| are logically from is, say, 'br0'. |
| |
| |
| |
| Lennert Buytenhek, November 7th 2001 |
| <buytenh@gnu.org> |
| |
| |
| |
| -------------------------- |
| Bridge+firewalling with 2.2 kernels is also possible, but deprecated. I |
| would severely recommend against using a 2.2 kernel and ipchains for bridge |
| firewalling. But if there's really a need, it's still possible. Apply the |
| extra firewalling patch available from the 'patches' section to your |
| already-patched-with-the-vanilla-bridge-patch 2.2 kernel, and recompile. Now |
| if you boot this kernel, the bridging code will check each to-be-forwarded |
| packet against the ipchains chain which has the same name as the bridge. So.. |
| if a packet on eth0 is to be forwarded to eth1, and those interfaces are |
| both part of the bridge group br0, the bridging code will check the packet |
| against the chain called 'br0'. If the chain does not exist, the packet will |
| be forwarded. So if you want to do firewalling, you'll have to create the |
| chain yourself. This is important! |
