0

In a given machine I have got two interfaces eth0 and eth1. Cisco routers are connected, to both interfaces, eth0 and eth1 and I want OSPF packets which arrives on eth0 to be forwarded to eth1 and vice versa (see image below).

I have tried issued the following commands:

iptables -A FORWARD -i eth1 -o eth0
iptables -A FORWARD -i eth0 -o eth1

But that did not work. Moreover, I wish this forwarding rule to apply on OSPF packets only, filtering packets by source and destination address and perhaps, even by protocol if possible. OSPF packets are appeared to be

IP 100.1.3.2 > 224.0.0.5: OSPFv2

from one direction, and

IP 100.1.3.1 > 224.0.0.5: OSPFv2

from the other.

{cisco}--(linux)--{cisco}

1 Answer 1

2

[In your question it is not clear to me if the linux box is acting as a bridge/layer 2 or as a layer 3 device, so I'm assuming the later.]

The OSPF Hello packets configured for a broadcast multiple-access network (i.e. ethernet) additionally to being sent to the multicast IP address of 224.0.0.5 are also sent to the multicast layer 2 ethernet MAC address of 01:00:5e:00:00:05. So unless your linux box is configured to bridge eth1 and eth0, the OSPF Hello packets will not make it across your firewall and the OSPF neighbor adjacencies will not be formed.

Then you have this other issue that the TTL for an OSPF Hello packet is 1 so it cannot cross layer 3 boundaries without getting expired in transit.

If you really, really want to do this, then you have to explore some other alternatives such as creating a GRE tunnel (an IPSec tunnel will also do the trick) between Router A and B and configure OSPF for a point-to-point link over this tunnel and then of course, allow through the firewall the traffic for the protocol you are using for the tunnel (i.e. 47 for GRE).

For a good reference on how to configure OSPF over a GRE tunnel take a look at: Configuring a GRE Tunnel over IPsec with OSPF (disregard the IPSec part if you will)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .