0

I have read countless articles on how to configure a network bridge and they all seem ambiguous or incomplete or just plain erroneous (configure my WAN port with 192.168.x.x to obtain Internet connectivity?).

My scenario: Ubuntu 16 and KVM with the wrinkle that security is via Sophos UTM running on the virtual machine. Physical machine has two Ethernet ports, only one of which has a cable inserted.

"Authorities" disagree on whether one must have one or two physical Ethernet ports to setup a bridge.

I am particularly confused by the seemingly dominant view that says you need only one port and you configure it so that the physical machine (PM) and the virtual machine (VM) share one IP address.

In that scenario how does the firewall work? Which machine receives whatever is passed by the firewall? And regardless of the answer, does not one machine become unreachable thereby? Or do both machines receive all passed packets?

I avoid the above confusion if I have two Ethernet ports and set up the bridge on the LAN port. Now I have an IP address leading into the VM and another remains pointed at the PM. Firewalling is now uncomplicated since I have different IP addresses for different targets.

But accounts of this second scenario never contain any discussion of firewalls or IP tables. But don't I need to have rules forwarding traffic between the two ports? My PC is not a router (not without configuration that is). Data packets coming in one port don't just magically find their way to the second port just because they share a common chassis do they?

I think the correct answer is the WAN port is assigned a public IP. The LAN port is bridged and given a private IP. Firewall rules then forward all traffic, except SSH (so I have a way to remote into PM still), from the WAN to the LAN port. I then configure Sophos on the VM to do the heavy lifting firewall-wise. The rest of the LAN is connected downstream of the Sophos VM. What do my IPtables config commands look like in and out?

I have spent hundreds of hours trying to figure this out myself. Help!

PS - One last question. Does the bridge get a public or private IP address? I assume it needs to have an address that is on the same network segment as the VM's attached to it have. In my case that means a private IP address.

0

you configure it so that the physical machine (PM) and the virtual machine (VM) share one IP address.

You can't share an IP, most likely the document make you NAT one IP to both VM/Host. A useless scenario to run a firewal appliance.

In that scenario how does the firewall work? Which machine receives whatever is passed by the firewall? And regardless of the answer, does not one machine become unreachable thereby? Or do both machines receive all passed packets?

No, a I said you can't share an IP. The first machine to get it's MAC address listed in the switch cache win, the other machine will detect a duplicate IP on the network and will stop right there. See that for the way it's done:

When starting up, Windows performs a gratuitous ARP to detect any
duplication with its own IP address. While this detects most cases of
duplicate IP addresses, in a few situations two TCP/IP hosts (either
Microsoft or non-Microsoft) on the same network can be configured for
the same IP address.

The MAC and IP address mapping is done by the ARP module, which uses
the first ARP response it receives. Therefore, the impostor computer's
reply sometimes comes back before the intended computer's reply.

Reference

But accounts of this second scenario never contain any discussion of firewalls or IP tables. But don't I need to have rules forwarding traffic between the two ports? My PC is not a router (not without configuration that is). Data packets coming in one port don't just magically find their way to the second port just because they share a common chassis do they?

Each port is isolated, unless it's a switch.

PS - One last question. Does the bridge get a public or private IP address? I assume it needs to have an address that is on the same network segment as the VM's attached to it have. In my case that means a private IP address.

The bridge got a public address but it's configured inside your router. The bridge itselft is between. A simple drawing to show a bridge setup for an ISP:

enter image description here

Often such scenario are for ISP that use PPPoE, the first router in that drawing get it's configuration from the ISP mainstream's server and automaticly become a bridge.

You can test it too, if you reset the ISP router by default without the ISP's link plugged it will become a standard router, with the 192.168.1.1 IP usually.

The missing point in your setup is you need another network card in your Sophos, to talk to your LAN, that unused NIC will find a use for that. In the KVM I don't know how you setup your port, but in an ESX can attribute it for your LAN, so the Sophos and the host got different IP, but the traffic will go by there in the day you plug that into a switch.

  • Thank you for the high quality answer! This is much more complicated to implement than it appears on the surface. Is it better to use IPtables or EPtables to route eth0 to eth1 on the Host? – gbambo Oct 14 '17 at 3:33
  • So as I understand it now, PM has two ethernet ports. One connects to the internet and the other is aliased into the bridge. And he later gets a public IP address which is taken over by the bridge. The forward VM has two NICs, one attached to the bridge and one attached to the internal LAN. The other machines on the internal LAN have no direct connection to the bridge. This internal LAN is routed by Sophos. – gbambo Oct 14 '17 at 3:45
  • @gbambo Iam not sure I follow you, but PM and VM got a NIC in the private LAN and VM got another NIC for the internet, simple as that – yagmoth555 Oct 14 '17 at 11:52
  • Wierd, 'cause I thought you were saying that PM and VM got a NIC in the PUBLIC LAN and VM got another NIC for the PRIVATE LAN. If PM only has a private IP I can't connect to the Internet until after I boot up the VM, yet my PM is remote! – gbambo Oct 14 '17 at 18:36
  • @gbambo Then dont do a sophos... its the risk you have. As the way you want could work if you got multiple ip from your isp. As the way you want need a simple hub, to plug in your VM and to plug into your PM, that way both machine talk to the ISP. Plugging a host direct on the internet is a security risk too – yagmoth555 Oct 14 '17 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.