From 9ea96e2d24e2576a995f766c1fd0de1dd3f1f50e Mon Sep 17 00:00:00 2001 From: Bart De Schuymer Date: Sat, 15 Feb 2003 13:47:40 +0000 Subject: added some entries --- docs/ebtables-faq.html | 203 +++++++++++++++++++++++++++++++++---------------- 1 file changed, 139 insertions(+), 64 deletions(-) (limited to 'docs') diff --git a/docs/ebtables-faq.html b/docs/ebtables-faq.html index e40ed48..8fafbc2 100644 --- a/docs/ebtables-faq.html +++ b/docs/ebtables-faq.html @@ -11,7 +11,7 @@ + "FAQ, kernel, ebtables, br-nf, br-nf-bds, ethernet, nat, chains, rules, tables">

@@ -30,15 +30,18 @@

Intro

What is the ebtables?: The ebtables project is the Linux 2.4.x Link Layer - firewalling subsystem. It delivers for Linux the functionality of +
What is ebtables?: The ebtables project is the Linux 2.5.x (and above) Link Layer + firewalling subsystem, a patch for 2.4.x is maintained too. + It delivers for Linux the functionality of Ethernet frame filtering, all kinds of frame NAT (Network Address - Translation) and frame matching. Currently ebtables is not a part - of 2.4.x kernels, but now in the >=2.5.40 kernels.
Why do I use it?: Probably, to filter frames by MAC-address or frame type at - Link Layer inside Your Linux-based Ethernet bridge.; To filter frames by MAC-address or frame type at + Link Layer inside your Linux-based Ethernet bridge, to do + some basic filtering of certain protocol headers, to + make a Linux brouter.

@@ -46,51 +49,61 @@

Installation

What should I do to know before ebtables installation?

First step is to check what the kernel version will be used - with ebtables. If the kernel version above than 2.5.39 was - installed, then kernel sources need no to be patched by the - ebtables_kernel and br-nf-bds patches. Go to Ethernet bridge - tables and download br_nf_bds, ebtables_kernel - and ebtables packages.

What is the "ebtables_kernel" package and why should I use - it?

What should I know before ebtables installation?

First step is to decide what kernel version to use. If you + want to use a 2.5.x (or above) kernel, then just use the latest + and greatest kernel version. You won't have to patch the kernel. + Check out the submitted kernel patches, available through the + + sourcecode section of the ebtables + homepage to see if there have been patches applied in later + kernel versions than the one you are using.

If you want to use a 2.4.x kernel, then go to + Ethernet bridge + tables and download the br_nf_bds, ebtables_kernel + and ebtables packages. Use the latest packages and use the + kernel version for which the kernel patches were made. The + ebtables_kernel patch has to be applied before the br_nf_bds + kernel patch.

What is the "ebtables_kernel" package and how do I install it?

The ebtables_kernel package contains a patch against a - Linux kernel. It allows filtering on the Link Layer (OSI Layer - 2). Well know that iptables works on the Network Layer (OSI - Layer 3) and on the upper layers. For a bridging firewall it is - important to be able to filter on Link Layer as well. Copy - patch file to the kernel source (usually it named - /usr/src/linux or /usr/src/linux-2.X.YY) and execute + Linux 2.4.x kernel. It allows filtering on the Link Layer (OSI Layer + 2). It is well-known that iptables works on the Network Layer (OSI + Layer 3) and on higher layers. For a bridging firewall it is + important to be able to filter on the Link Layer as well.

Copy the patch file to the kernel source (usually it is named + /usr/src/linux or /usr/src/linux-2.X.YZ) and execute the following + (use the correct file names and directories where necessary)

+# cd /usr/src/linux
 # cp ebtables-v2.0.003_vs_2.4.20.diff.gz /usr/src/linux
 # gunzip ebtables-v2.0.003_vs_2.4.20.diff.gz 
 # patch -p1 < ebtables-v2.0.003_vs_2.4.20.diff

What is the "br-nf-bds" package and why should I use it?

What is the "br-nf-bds" package and how do I install it?

- The br-nf-bds package contains a patch against Linux + The br-nf-bds package contains a patch against a Linux kernel that is already patched with the ebtables_kernel - patch. It add ability of iptables usage on a bridge to make a - bridging firewall. The big part of this patch was complete by + patch. It adds the ability of iptables usage on bridge packets to make a + bridging firewall. Most work on this patch was done by Lennert Buytenhek. The bridge-nf code is automatically compiled into the patched kernel if the bridge and netfilter support is enabled.

+# cd /usr/src/linux
 # cp bridge-nf-0.0.10-against-2.4.20.diff.gz /usr/src/linux
 # gunzip bridge-nf-0.0.10-against-2.4.20.diff.gz
 # patch -p1 < bridge-nf-0.0.10-against-2.4.20.diff

What is the "ebtables" package and why should I use it?

What is the "ebtables" package and how do I install it?

The ebtables package contains the ebtables userspace - tool. Namelly this ebtables binary is used to make filtering - rules for the Linux-based Ethernet bridge. The rules is applied - for bridged packets at Link Layer. The ebtables usage is very + tool. This ebtables binary is used to make filtering + rules for the Linux-based Ethernet bridge. All traffic entering + or leaving on a bridge port will be seen by the rules. The ebtables usage is very similar to the iptables, so it should not be so hard. Of course, there is a man page supplied. Just gunzip and untar the package and read the INSTALL file.
@@ -98,8 +111,8 @@

 # make

- Put ebtables binary to the superuser binaries directory (f.e. - /usr/sbin) manually or + Copy the ebtables binary, man page and protocol file to the correct + directory (see the INSTALL file for options):

 # make install

@@ -111,27 +124,94 @@

Usage

Can I drop the ARP packets in linux bridge box using the +
Can I filter on ARP packets in the Linux bridge box using ebtables?: Yes, it's possible to filter the ARP packets (same as any - other Ethernet frames) using linux bridge and ebtables together. - According to the rule target, the frame can be dropped, accepted, - passed to next rule, etc.
- See the ebtables manual page for +; Yes, it's possible to filter on the ARP header, using ebtables. + See the ebtables manual page for details.
Can I use ebtables with iptables? Is there any problems to +
Can I use ebtables with iptables? Are there any problems to use it together?: Yes, it's possible to use ebtables with iptables. Detailed - info about ebtables/iptables interaction is explained at the page - "ebtables/iptables interaction on a - Linux-based bridge"
Can ebtables to do a frame accounting on my bridge?

Does ebtables keep count statistics?

- Yes, it's possible to view bridged frames and bytes count by + Yes, it's possible to view the match and byte count for every rule, using

 # ebtables -L --Lc

When using the option --Lc, what does the pcnt value represent?

+ Normally, pcnt will represent the number of frames that matched this rule. However, + if IP connection tracking is enabled, all fragmented IP packets will first be + defragmented. Therefore, the pcnt value for IP packets will then represent the + number of matched IP packets, not the number of matched frames containing IP fragments. + In the BROUTING chain however, pcnt will always represent the number of matched frames, since + the IP connection tracking is not done before this chain is traversed. +

What is this brouter stuff and when is it useful?

+ The ebtables BROUTING chain gets traversed very early, namely right after a frame + is received on a forwarding bridge port. If a rule's decision is to route the frame, + the input device will remain the physical device of the bridge port and the bridge + code won't touch the frame. The frame will be processed by the network stack. If the + decision is to bridge the frame (the default behaviour), then the input device will + become the bridge device on which the port is enslaved and the bridge code will decide + what to do with the frame.

So, what's the difference between the ebtables BROUTING and PREROUTING chains?

The ebtables PREROUTING chain is only traversed when the bridge code is deciding what + to do with the frame. So, if a BROUTING chain rule decided the frame should be routed, then + the ebtables PREROUTING chain won't see it. See the + + br_fw_ia page for the details.

I'm using a 2.5.x or higher kernel and my iptables rules won't match on the bridge port + devices, what's wrong?

+ There is one difference between the br-nf behaviour in the 2.5.x or higher kernels and + the 2.4.x patch. To get the br-nf code accepted into the standard 2.5.x kernels, we had to + remove the code that automatically checked on the bridge port in the iptables port checking + code (options -i and -o). Instead there is now an iptables match module that you have to use + to filter on the bridge ports. This kernel module is in the standard 2.5.x kernels and the + corresponding userspace module is available in the iptables userspace tool. See the iptables + man pages and +

+#iptables -m physdev -h
+

+ The kernel module has to be compiled in the kernel, the option ``physdev match support'' will + appear under the ``IP netfilter configuration'' when the bridge is already enabled in the + configuration. +

I want to use the most recent ebtables code, even if it's not yet in an official release. + How do I do this?

+ The most recent code is available at the + sourceforge ebtables CVS repository. To get a copy of the repository, do the following: +

+#cvs -d:pserver:anonymous@cvs.sourceforge.net:/cvsroot/ebtables login
+#cvs -z3 -d:pserver:anonymous@cvs.sourceforge.net:/cvsroot/ebtables co ebtables2
+

+ The current userspace code is in the ebtables2/userspace/ebtables2 directory. To compile the + CVS userspace tool you'll need to do the following: +

+#make NONSTANDARD=y KERNEL_INCLUDES=/usr/src/linux/include/
+#make install
+

+ Obviously you'll need to use the right kernel directory. Why is compiling the CVS different? + Because the kernel include files are not maintained in the userspace directory of the CVS. + When a new ebtables release is made, the kernel include files get copied in the tar file, so + the standard installation knows where to get its kernel include files.

To copy the ebtables kernel 2.4.x code to a full 2.4.x kernel tree, use this script: +

+ebtables2/kernel/scripts/CopyRep
+

+To copy the ebtables kernel 2.5.x code to a full 2.5.x kernel tree, use this script: +

+ebtables2/kernel/scripts/CopyRep2.5
+

+ You'll need to adjust the variables $FROM and $TO in the script, for more information: read the + script.

@@ -140,26 +220,21 @@

Other

I'm not a Linux system programer, but I need a feature, which - is not (yet) implemented in the ebtables. What should I do?: Contact by email to ebtables developers directly or subscribe - to the ebtables - users mail list. Then post short and clean description of - Your wanted feature to mail list.
I'm Linux system programmer and I can do any ebtables feature by - myself. What I should begin in that case?
I'm not a Linux system's programmer, but I need a feature, which + is not (yet) implemented in ebtables. What should I do?: Subscribe to the + ebtables users mailing list. Then post a short and clean description of + your wanted feature to this mailing list.
I'm a C programmer and I want to add an ebtables feature by + myself. Where should I begin?: Subscribe to the ebtables - developers mail list. Learn the "Ebtables Hacking HOWTO". - Create Your account at SourceForge.net (if You still haven't it) - and inform the Project Admin about Your intention to join to - ebtables developers and to make a new ebtables feature. After - that You should be able to working with ebtables source code, - which is placed at SourceForge cvs repository. Now You can make - Your ebtables feature or anything else (to drink a cup of coffee, - f.e. ;).

-- cgit v1.2.3