Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 0 down vote favorite
1

I wanted to go a little bit further and install EBtables (the 2-layer filtering and routing table). The purpose of it was to only allow the minimal necessary(IPv4 and ARP). To test it I ran:

ebtables -P INPUT DROP
ebtables -P FORWARD DROP
ebtables -P OUTPUT DROP

Then, I tested it, ping 8.8.8.8, and surely enough, I got a reply. I tried a couple of other combinations, checked there are no other tables, but ping still worked. If EBtables can't block/filter, it is pointless.

I am NOT trying to block ICMP, I am trying to block everything except IPv4. To test EBtables, I tried using ICMP, but it was not blocked (meaning EBtables don't work).

What am I doing wrong? (Debian Squeeze, iptables and whatnot, EBtables v2.0.9-2)

share|improve this question
I would change the title to "How do you block non-IP traffic?" – Shawn J. Goff Jun 13 '11 at 16:51

3 Answers

up vote 1 down vote

It is not working because ebtables is supposed to be used only with bridged devices (I assume this is not your case). Look at iptables instead.

share|improve this answer
and if I have more than one interfaces? (eth0, eth1) – user Jun 13 '11 at 14:07
up vote 0 down vote

It doesn't sound like you have a use for ebtables at all. Ebtables is for dealing with traffic routed across bridged devices. The use case you describe is controlled by iptables.

Ping uses ICMP packets an can be blocked using the icmp protocol option on iptables.

iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP
share|improve this answer
I don't care about ICMP specifically, the final goal is to block IPx and all the rest. To test it, I blocked all traffic both in and out, and surely ping ought not to work in this situation. – user Jun 13 '11 at 13:48
It doesn't sound like you have a network situation appropriate for ebtables. You can block all network traffic with iptables, just change ebtables to iptables in the commands in your question. – Caleb Jun 13 '11 at 13:59
iptables can only block IP traffic, anything else just goes under the radar – user Jun 13 '11 at 14:07
@user: It doesn't "go" under the radar because it doesn't "go" anywhere! The only time non IP traffic would get moved across an interface is if it was being transported to another interface, which is what ebtables is about controlling. In a one interface system this stuff is out there on the wire, but not affecting your system so ebtables is useless. – Caleb Jun 20 '11 at 11:41
up vote 0 down vote

Everyone else is correct about your mis-use of ebtables. However, to actually answer your question, if all you did was enter the above commands and nothing more, the reason why it didn't work is that those commands just modify the "policy," which is what ebtables does with a packet when it doesn't have a chain to go through or if a packet goes through a chain without getting picked up by a rule.

So you likely have some chains that packets are going through that are getting picked up by an ACCEPT rule.

The typical way to use any "x"tables is to clear all chains first, then set policies, then enter chains, and then populate the chains with rules.

share|improve this answer
nope, ebtables -x, added rule -j DROP and also -i eth0 DROP -o eth0 DROP where applicable, changed policy for PREROUTING, POSTROUTING, OUTPUT, and BROUTING, still the same. Try it! – user Jun 13 '11 at 16:32
Ok, looks like @Petr Uzel and @Caleb are correct. Your interface must be part of a bridge. So make a single interface "bridge" with brctl (name it br0) and then see if you can put ebtables rules on br0. – ultrasawblade Jun 13 '11 at 20:38
huh. I'll check that. What happens if non IPv4 traffic goes through eth0? Is there a way to block that? The general idea is to block non-ipv4 viruses, because non-ipv4 traffic is known to bypass firewalls. – user Jun 14 '11 at 14:13
ok, I brctl'ed eth0 into br0. Then I didn't have any destination reachable at all, regardless of ebtables. What now? – user Jun 14 '11 at 15:30
br0 is now your new eth0. Have you updated your iptables to reflect that? – ultrasawblade Jun 14 '11 at 15:59
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.