Re: [Xen-users] Xen with 'Routing' scripts

[Nils Toedtmann <xen-users@xxxxxxxxxxxxxxxxxx>]

Am Montag, den 18.04.2005, 16:02 +0200 schrieb Roland Paterson-Jones:
> 
> Nils Toedtmann wrote:
> 
> >Am Sonntag, den 17.04.2005, 18:56 +0200 schrieb Roland Paterson-Jones: 
> I'm assuming iptables doesn't see bridged ethernet traffic(!?)
[...]
> >* iptables to enforce the correct IP (--> no IP spoofing)
> Does iptables get to see ethernet-bridged traffic? I thought ethernet 
> traffic snuck through under the iptables radar since it doesn't 
> (shouldn't?) touch the IP stack.

That depends. In the old days of linux-2.4 you needed the br-nf-patch
from the ebtables site to make bridged ip packets visible to iptable.
But as i already said there is now "CONFIG_BRIDGE_NETFILTER" in
linux-2.6: if you compile a kernel with "CONFIG_BRIDGE_NETFILTER=y" (as
all distributers i know do and as xen does in it's default dom0 config)
then iptables sees every forwarded frame which has ethertype 0x0800
(IPv4). If you want it more detailed, see this netfilter/ebtables flow
chart:

  <http://l7-filter.sourceforge.net/PacketFlow.png> 

So: everything you want to filter you can filter with bridging.

/nils.


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users