I have a Linux SBC (single board card) that has dual ethernet + wifi. I want to create a bridge using the two ethernet interfaces as slave interfaces. The aim is to use the device to sniff the traffic between two machines. There is also a wifi access point on wlan running hostapd.
The bridge does not seem to be fully isolated from traffic originating from other interfaces.
I would like to use NetworkManager because I like the convenience of being able to switch from one connection profile to another. From time to time I want to bring the bridge down and raise eth0/1 in DHCP to perform system updates. The wifi access point would continue to run unaffected.
My interfaces and MAC addresses are as follows:
eth0 70:cf:49:92:30:c5 eth1 70:cf:49:92:30:c6 wlan0 70:cf:49:92:30:c7
(The MAC addresses are spoofed)
Output of /etc/network/interfaces:
source /etc/network/interfaces.d/* auto lo iface lo inet loopback
I created the bridge as follows with nmcli:
nmcli connection add type bridge ifname br0 con-name br0 ipv4.method disabled ipv6.method ignore bridge.stp no nmcli connection modify br0 connection.autoconnect-slaves 1 # add slaves: eth0, eth1 nmcli con add type ethernet slave-type bridge con-name br-slave-eth0 ifname eth0 master br0 autoconnect no nmcli con add type ethernet slave-type bridge con-name br-slave-eth1 ifname eth1 master br0 autoconnect no
Based on this blog post: Proper isolation of a Linux bridge I created a pre-up hook as follows:
File name: /etc/NetworkManager/dispatcher.d/pre-up.d/01-vlan-filtering
#!/bin/sh iface=$1 action=$2 if [ "$iface" = "br0" ] && [ "$action" = "pre-up" ] ; then bridge vlan del dev br0 vid 1 self echo 1 > /sys/class/net/br0/bridge/vlan_filtering fi
Although I doubt this actually has any meaningful effect.
bridge vlan show:
port vlan ids eth0 1 PVID Egress Untagged eth1 1 PVID Egress Untagged br0
I have also defined additional profiles (disabled by default) for eth0 and eth1 (regular DHCP). They are shown at the bottom.
nmcli con show:
NAME UUID TYPE DEVICE br0 677631d9-c9fa-4ec2-a666-e2c764300d8b bridge br0 br-slave-eth0 8f6c705b-a71e-4f2e-9092-ccf055edaf41 ethernet eth0 br-slave-eth1 2bb50af6-d047-4f16-896b-de7e11e0c98a ethernet eth1 eth0 92dbf4c5-65ce-42ad-9dec-200d1bac6931 ethernet -- eth1 fcec5a74-16d5-419e-8fb2-9ff8c4455f32 ethernet --
The first 3 lines: br0, br-slave-eth0, br-slave-eth1 are in green, indicating that the interfaces are connected and active.
The bridge works and is forwarding traffic as expected. However, it is evident that is not fully isolated. In order to verify isolation I connected both eth0 and eth1 to a Cisco managed switch (ports 6 and 7) and I have enabled port mirroring (SPAN) to port 8 on the Cisco switch to copy all packets to a dedicated network interface on my desktop PC, that is running Wireshark so I can see the packets passing through the bridge.
From time to time I see IGMPv3 packets as shown in attached screenshot. Some seem to come from wlan0. I can reproduce this traffic using Scapy on the SBC. PoC code:
from scapy.all import Ether, IP, sendp from scapy.contrib.igmpv3 import IGMPv3, IGMP, IGMPv3gr, IGMPv3mr packet = Ether(dst='01:00:5e:00:00:16', src='70:cf:49:92:30:c5') / IP(src='0.0.0.0', dst='188.8.131.52', tos=0xc0) /IGMPv3() /IGMPv3mr(numgrp=1) /IGMPv3gr(rtype=4, maddr="184.108.40.206") packet.show() sendp(packet, iface='eth1')
I have a sniffer running on top of the bridge that performs live packet analysis and the traffic flowing through the bridge must not be tainted with traffic from other interfaces.
How can I achieve full isolation of the bridge ? I understand that I could use ebtables to selectively drop packets but am I missing something obvious perhaps ?
- OS: Armbian Buster: Linux nanopir1 5.10.4-sunxi #20.11.7 SMP Tue Jan 5 23:17:54 CET 2021 armv7l GNU/Linux
- network-manager: 1.14.6-2+deb10u1
- I have the br_netfilter module loaded (and 8021q as well)