2

I am using the following setup on my Linux machine:

Two bridges exist in the system with the following interfaces:

bridge_default -

  1. LAN
  2. WAN

bridge_1 -

  1. WLAN1

I would like to isolate between the interfaces so that messages arriving from interface WLAN1 will not be able to reach LAN interface (on bridge_default) - only to WAN interface.

In order to do so, I've set the following rules:

Chain DEFAULT_FORWARD (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  wlan1 wan  0.0.0.0/0            0.0.0.0/0
    0     0 DROP       all  --  bridge_default wlan1  0.0.0.0/0            0.0.0.0/0

Chain DEFAULT_INPUT (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  wlan1 wan  0.0.0.0/0            0.0.0.0/0
    0     0 DROP       all  --  bridge_default wlan1  0.0.0.0/0            0.0.0.0/0

Chain DEFAULT_OUTPUT (1 references)
pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  wlan1 wan  0.0.0.0/0            0.0.0.0/0
    0     0 DROP       all  --  bridge_default wlan1  0.0.0.0/0            0.0.0.0/0

However, when I actually testing this configuration, I've noticed that the behaviour is not as expected. To be more specific, the log shows that messages arrive from bridge_1 and not from the interface WLAN1:

IN=bridge_1 OUT= PHYSIN=wlan1 MAC=00:e0:92:00:01:51:e8:2a:ea:18:60:7d:08:00 S RC=192.168.2.101 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=21154 PROTO=ICMP TYPE=8 CODE=0 ID=6 SEQ=6891

EDIT

Results of iptables-save command are presented below:

-A DEFAULT_FORWARD -i wlan1 -o wan -j ACCEPT
-A DEFAULT_FORWARD -i bridge_default -o wlan1 -j DROP
-A DEFAULT_INPUT -i wlan1 -o wan -j ACCEPT
-A DEFAULT_INPUT -i bridge_default -o wlan1 -j DROP
-A DEFAULT_OUTPUT -i wlan1 -o wan -j ACCEPT
-A DEFAULT_OUTPUT -i bridge_default -o wlan1 -j DROP

A list of available NICs:

root@ugwcpe:~# ip link show
1: lo: <LOOPBACK,UP,LOWER_UP,80000> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
8: eth0_1: <NO-CARRIER,BROADCAST,MULTICAST,UP,80000> mtu 1500 qdisc pfifo_fast master default_bridge state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:e0:92:00:01:40 brd ff:ff:ff:ff:ff:ff
9: eth0_2: <NO-CARRIER,BROADCAST,MULTICAST,UP,80000> mtu 1500 qdisc pfifo_fast master default_bridge state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:e0:92:00:01:41 brd ff:ff:ff:ff:ff:ff
10: eth0_3: <NO-CARRIER,BROADCAST,MULTICAST,UP,80000> mtu 1500 qdisc pfifo_fast master default_bridge state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:e0:92:00:01:42 brd ff:ff:ff:ff:ff:ff
11: eth0_4: <NO-CARRIER,BROADCAST,MULTICAST,UP,80000> mtu 1500 qdisc pfifo_fast master default_bridge state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:e0:92:00:01:43 brd ff:ff:ff:ff:ff:ff
12: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP,80000> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
    link/ether 00:e0:92:00:01:44 brd ff:ff:ff:ff:ff:ff
15: default_bridge: <BROADCAST,MULTICAST,UP,LOWER_UP,80000> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
    link/ether 00:e0:92:00:01:40 brd ff:ff:ff:ff:ff:ff
16: wan@eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP,80000> mtu 1500 qdisc noqueue state LOWERLAYERDOWN mode DEFAULT group default
    link/ether 00:e0:92:00:01:45 brd ff:ff:ff:ff:ff:ff
17: rtlog0: <BROADCAST,MULTICAST,UP,LOWER_UP,80000> mtu 1500 qdisc pfifo_fast master default_bridge state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether 00:e0:92:00:01:40 brd ff:ff:ff:ff:ff:ff
18: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP,80000> mtu 1500 qdisc pfifo_fast master default_bridge state UP mode DEFAULT group default qlen 1000
    link/ether 00:e0:92:00:01:50 brd ff:ff:ff:ff:ff:ff
25: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP,80000> mtu 1500 qdisc pfifo_fast master default_bridge state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether 00:e0:92:00:01:51 brd ff:ff:ff:ff:ff:ff
26: wlan0.1: <BROADCAST,MULTICAST,UP,LOWER_UP,80000> mtu 1500 qdisc pfifo_fast master default_bridge state UNKNOWN mode DEFAULT group default qlen 1000
    link/ether 00:e0:92:00:01:52 brd ff:ff:ff:ff:ff:ff

Default Forward rules:

-A DEFAULT_FORWARD -i bridge1 -o wan -j ACCEPT
-A DEFAULT_FORWARD -i wan -o bridge1 -j ACCEPT
-A DEFAULT_FORWARD -i default_bridge -o bridge1 -j DROP
-A DEFAULT_FORWARD -i bridge1 -o default_bridge -j DROP
-A DEFAULT_FORWARD -i bridge1 -o wan -j ACCEPT
-A DEFAULT_FORWARD -i wan -o bridge1 -j ACCEPT
-A DEFAULT_FORWARD -o bridge1 -j DROP
-A DEFAULT_FORWARD -i bridge1 -j DROP
-A DEFAULT_FORWARD -i wlan -o wan -j ACCEPT
-A DEFAULT_FORWARD -i wan -o wlan -j ACCEPT
-A DEFAULT_FORWARD -o wlan -j DROP
-A DEFAULT_FORWARD -i wlan -j DROP

Can someone please help me and point out on what am I doning wrong?

Thank you all in advance!

  • can you edit the question and post the result of iptables-save – Wissam Roujoulah Dec 5 '16 at 13:27
  • Sure @Wissam Al-Roujoulah – dear_tzvi Dec 5 '16 at 13:33
  • how do you use wan for one time and use bridge_default for next time. can you list the NICs you have – Wissam Roujoulah Dec 5 '16 at 14:54
  • These are two different rules as far as I see. I'm setting rules towards WAN - In my case, all packets should pass. The other rule is facing default_bridge - where I want to DROP all packets so no packets will pass – dear_tzvi Dec 5 '16 at 15:20
  • @Wissam Al-Roujoulah - Do you need any other information? – dear_tzvi Dec 6 '16 at 9:15
0

You are not preventing messages from wlan1 from passing to lan.

I'm little confuse about the NICs.

try this:

-A DEFAULT_FORWARD -i wlan1 -o wan -j ACCEPT
-A DEFAULT_FORWARD -i bridge_default -o wlan1 -j DROP
############# ADDED #################################
-A DEFAULT_FORWARD -i wlan1 -o bridge_default -j DROP
#####################################################
-A DEFAULT_INPUT -i wlan1 -o wan -j ACCEPT
-A DEFAULT_INPUT -i bridge_default -o wlan1 -j DROP
-A DEFAULT_OUTPUT -i wlan1 -o wan -j ACCEPT
-A DEFAULT_OUTPUT -i bridge_default -o wlan1 -j DROP

Any packet will not pass to bridge_default if it didn't match by the first rule you added -i wlan1 -o wan -j ACCEPT

  • I did as suggested, but result remains the same - Packets are still not dropped – dear_tzvi Dec 6 '16 at 9:59
  • @dear_tzvi can you post the rule that redirect to DEFAULT_FORWARD chain ? – Wissam Roujoulah Dec 6 '16 at 10:01
  • 1
    I will edit the question and add these details – dear_tzvi Dec 6 '16 at 10:05
  • I think my problem is because Interface name is being replaced with bridge name. Is that a normal behavior? What can I do about it? – dear_tzvi Dec 6 '16 at 13:30
  • @dear_tzvi i asked you to post your NICs and the rules that redirect to the chain – Wissam Roujoulah Dec 6 '16 at 13:41
0

The problem described here is due to the fact that iptables are only apply after linux stack can be solved by several methods:

  1. Use ebtables instead of iptables -

As ebtables apply rules on ETH layer, we can apply rules on the actual interface, and not as described here were as the packet arrives to Linux bridge, it is being edited and changed so IN value will be the bridge

  1. Use bridge_1 instead of Interface -

If the same up table rules will be applied on the bridge instead of the interface - no problem will occur and rules will work fine

  • @@Wissam Al-Roujoulah Updated – dear_tzvi Dec 6 '16 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.