Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am attempting to set up a semi-transparent bridge. I say semi because I want it to act as a transparent tap for all traffic moving through both sides of the bridge. What I also want is to have the "green zone" accessible to a web interface for the bridge that will display all results of the IDS and other network monitoring tools. My example would be as such:

eth0 <--> bridge(br0) <--> eth1

The entire network would be on the same subset however anything coming from eth0 to eth1 would be accepted. The only time anything would be drop is if the eth0 attempted to access br0. If someone attempts to access the web interface on br0 through eth1 it will succeed. My biggest problem I feel is if I attempt to block anything from eth0 to br0 this will drop the bridge all together.

share|improve this question

2 Answers 2

iptables -A INPUT -i eth0 --dport 80 -j DROP

Everything that's forwarded is handled by other chains, so if it's across the bridge it won't be affected. Those are handled by the FORWARD chain.

Here's a good reference example.

share|improve this answer
    
As a quick followup question to this, what exactly am I trying to build at this point? It's not really a transparent bridge, but depending on where you are you shouldn't be able to see it either. –  Blackninja543 Apr 11 '12 at 2:32
    
what exactly am I trying to build at this point I think you need to tell me that one. It sounds like you want a bridge that has an IP address and is accessible. This is basically a managed switch with 2 ports. –  Jeff Ferland Apr 11 '12 at 14:00

So: eth0=lan1 eth1=lan2 br0=briges both + has an IP that should be accessible by eth1 only - right?

For iptables and birdges use the physdev module in iptables

iptables -A INPUT -p ALL -d the.ip.on.br0 -m physdev --physdev-in eth0 -j DROP

would DROP connections to br0 when they came in via eth0 (or reverse and ACCEPT there, depends on your other rules)

share|improve this answer
    
This didn't work any ideas why something like: iptables -A INPUT -i eth0 -p TCP --dport 80 -j DROP wouldn't work either? –  Blackninja543 Apr 11 '12 at 4:42
    
"didn't work"... i would need some more info... paste ip addr, brctl show and iptables-save please | the "-i eth0" @jeff suggested won´t work on a bridge See Why TL;DR: the 'join' happens before the packet reaches the kernel/iptables, so for iptables the "--input" would be br0 –  Tabakhase Apr 11 '12 at 15:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.