4

My server running on latest kernel (4.4.6) has configured a bond device (bond0) with two enslaved interfaces eth0, wlan0 with primary interface eth0.

cat /proc/net/bonding/bond0 
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)

Bonding Mode: fault-tolerance (active-backup)
Primary Slave: eth0 (primary_reselect always)
Currently Active Slave: wlan0
MII Status: up
MII Polling Interval (ms): 1000
Up Delay (ms): 1000
Down Delay (ms): 1000

Slave Interface: wlan0
MII Status: up
Speed: Unknown
Duplex: Unknown
Link Failure Count: 3
Permanent HW addr: dc:53:60:5f:50:cd
Slave queue ID: 0

Slave Interface: eth0
MII Status: down
Speed: Unknown
Duplex: Unknown
Link Failure Count: 4
Permanent HW addr: b8:ae:ed:7c:7d:c9
Slave queue ID: 0

I run also iptables to filter traffic and block some local ports while I allow all outgoing traffic.

*filter
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8090 -j ACCEPT

What I have fail to do is to create a mechanism when the primary interface eth0 is down and the wlan0 is getting active to block the remote access on specific port.

I tried to add an iptable rule for wlan0 while I know that is not correct because the interface is bond0 (Failed)

*filter
-A INPUT -p tcp -i wlan0 -m state --state NEW -m tcp --dport 8090 -j DROP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8090 -j ACCEPT

I tried to add an iptable rule for wlan0 to mark packets on preroute and catch on filter (Failed)

*mangle
-A PREROUTING -i wlan0 -j MARK --set-xmark 0x1/0xffffffff
*filter
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8090 -m mark ! --mark 0x1 ACCEPT

I tried to add an ebtable rule to mark packets on Layer2 and catch on Layer3 filter (Failed)

EBTABLE
ebtables -t broute -A BROUTING -p ipv4 -i wlan0 -j mark --set-mark 0x1 --mark-target ACCEPT

IPTABLE
*filter
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8090 -m mark ! --mark 0x1 ACCEPT

I would like to avoid the MAC address solution because it will not work on Mac Policy: None

Any Ideas?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.