[keeping NottsLUG in for info!]
On Tue, 29 Jan 2002, Martin Hamilton wrote:
> I've faffed quite a bit, as Loughborough Uni's firewall is a Linux box
> (Dell 2550) running ipchains over the Lennert Buytenhek bridging code.
Yeah, I have plenty of experience of this since I've built a fair few
systems like that! Using multiple Ethernet NICs is no problem at all,
performance is good (with a modest chainset) and I've not had a problem
with the bridging since the first one I made work.
> I'm running with no IP addresses on br0
I am, br0 has a 'private' IP address. I say 'private' since it's not
RFC1918 space, just one that no-one can see :)
> br0 needs to be "up", as per "ifconfig br0 up".
Yup, it is. As are eth0 and eth1 [note: eth1 is the pseudo-interface on
the USB port]
> What does brctl say it thinks is happening?
As far as it's concerned, br0 is up and comprised of the two ports. STP is
off.
> "tcpdump -eqntl -i ethN" or similar ought to show you if some/any packets
> are getting through
OK, here's the rub. If I set (say, and just for now ignoring my "not
RFC1918 space" comment above!) br0 to have 192.168.1.1, and have a machine
behind it as follows:
INSIDE
machine1 eth0 192.168.1.2
|
bridge eth1
bridge br0 192.168.1.1
bridge eth0
|
rest of 192.168.1.0/24
OUTSIDE
and... INSIDE can see br0 on the bridge.
OUTSIDE can see br0 on the bridge.
The bridge can see both INSIDE and OUTSIDE.
INSIDE _cannot_ see OUTSIDE and vice versa.
That last statement needs expanding slightly, in that the packets from
bridge eth0 never get forwarded to eth1, nor the other way around.
I suspect this comment from Jim'll may make it all quite plain:
> I've not used new-fangled USB ethernet adapters but I did play with
> kernel bridging and the Orinoco WLAN cards. They don't work either
> and its not an interrupt thing: the actual firmware in the card can't
> go into the proper promiscuous mode required to do bridging properly.
> You might want to check if the USB adapter can "get about a bit" with
> a tcpdump on a non-switched network before trying the bridging.
I rather suspect that either the hardware in the adapter just won't cut
it, or that the driver code for Linux hasn't implemented promiscuous mode
yet. Time to go a-digging!
Ta
Graeme
--------------------------------------------------------------------
http://www.lug.org.uk http://www.linuxportal.co.uk
http://www.linuxjob.co.uk http://www.linuxshop.co.uk
--------------------------------------------------------------------
This archive was generated by hypermail 2.1.3 : Tue 29 Jan 2002 - 11:17:59 GMT