Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to ask if this scenario is possible with Linux version 3.10 stock standard kernel to manage traffic in a transparent bridge mode. I have a connection now between the LAN switch to the one port of a firewall which inturn is connected to the internet. The LAN has 4 VLANs numbered(3,4,5,6) one four ports on the LAN switch and this is turn trunked (i hope that i am using the right terminology here) via one port of the switch to the firewall.

WAN ---- Linux Bridge ----- LAN

I want it insert an Linux box with 3 NIC, eth0, eth1 and eth3 where eth0 = LAN, eth1=WAN (where LAN and WAN are bridged br0) and eth3=management with ip to manage the box, where LAN, WAN and br0 are ip-less. My Question are:

1) Can iptables see all the source and destination IP of all the VLANS?

2) Can I rate limit certain IPs from any of the 4 VLANS?

3) Can iptables filter by VLAN-id?

4) ebtables can mark packet of certain VLAN-id but can this mark inturn be managed by iptables?

Thanks for helping.

Regards, Albert

share|improve this question

1 Answer 1

  1. Yes, because VLANs are handled in Linux with virtual interfaces eg eth0.75 for VLAN id 75 on physical interface eth0.

  2. I don't know, but I suspect so; given the above, any normal rate-limiting tools can be aware of the VLAN on which a packet arrived.

  3. Yes, using the usual filters for input and output interface.

  4. I don't know.

share|improve this answer
    
When you mentioned the virtual interfaces eg eth0.75, does that mean that the kernel automatically spin up an interface depending on the traffic passing through the bridge? –  AlbertK Apr 27 at 7:40
    
the kernel doesn't spin up any vlan interface automatically, you need to do it –  c4f4t0r Apr 27 at 10:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.