Filtering PPP traffic
Hi list,
Is there somebody who knows a possibility to apply netfilter rules to ppp packets ?
Configuration :
DSL - PCI modem card - BRIDGE - eth0 (in a virtual machine)
I would like to filter the traffic which flows across the bridge, but at this level, the IP traffic is encapsulated...
Any clue ?
Ciao.
Signature · 4 lines
Francis GASCHET / NUMLOG http://www.numlog.fr Tel.: +33 (0) 130 791 616 Fax.: +33 (0) 130 819 286
You should be able to filter at the "eth0" level of your diagram...
I kinda need more information on your "BRIDGE" before I could suggest something else.. If by bridge you mean it bridges the DSL modem and the LAN...then your eth0 is in the same machine you are calling a bridge?
In that case you should theoretically filter the eth0 device
Quoted 7 lines · --- Francis GASCHET
Hi list,
Is there somebody who knows a possibility to apply netfilter rules to ppp packets ?
Configuration :
Quoted 19 lines
DSL - PCI modem card - BRIDGE - eth0 (in a virtual machine)
I would like to filter the traffic which flows across the bridge, but at this level, the IP traffic is encapsulated...
Any clue ?
Ciao.
Signature · 4 lines
Francis GASCHET / NUMLOG http://www.numlog.fr Tel.: +33 (0) 130 791 616 Fax.: +33 (0) 130 819 286
=====
"No touchy NO TOUCHY! Emperor Kuzko -=Emperor's New Groove=-"
__________________________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo
http://search.yahoo.com
Hello,
The bridge we use is the kernel patch provided by http://bridge.sourceforge.net
On the card side, we use Ethernet over ATM bridging (RFC 1483/2684 kernel module). It emulates an "Ethernet like" device : nas0. The pppOE daemon sits in the VM where it reads and writes ppp frames on a virtual eth device created with TAP (http://Vtun.sourceforge.net).
The official address is carried by this virtual eth device.
The bridge forwards pppOE packets between the nas0 and the tap0 devices.
The goal is to use a bridged firewall. That means : a FireWall which is not visible from the external network.
The problem is to be able to filter the pppOE packets that flow across the bridge.
Signature · 9 lines
Francis GASCHET / NUMLOG http://www.numlog.fr Tel.: +33 (0) 130 791 616 Fax.: +33 (0) 130 819 286 Thanks for any help.
Quoted 28 lines · SBlaze
You should be able to filter at the "eth0" level of your diagram...
I kinda need more information on your "BRIDGE" before I could suggest something else.. If by bridge you mean it bridges the DSL modem and the LAN...then your eth0 is in the same machine you are calling a bridge?
In that case you should theoretically filter the eth0 device
Quoted 16 lines · --- Francis GASCHET
Hi list,
Is there somebody who knows a possibility to apply netfilter rules to ppp packets ?
Configuration :
DSL - PCI modem card - BRIDGE - eth0 (in a virtual machine)
I would like to filter the traffic which flows across the bridge, but at this level, the IP traffic is encapsulated...
Any clue ?
Ciao.
Have you tried filtering on the nas0 device?
Quoted 14 lines · --- Francis GASCHET
Hello,
The bridge we use is the kernel patch provided by
http://bridge.sourceforge.net
On the card side, we use Ethernet over ATM bridging (RFC 1483/2684 kernel module). It emulates an "Ethernet like" device : nas0. The pppOE daemon sits in the VM where it reads and writes ppp frames on a virtual eth device created with TAP (http://Vtun.sourceforge.net).
The official address is carried by this virtual eth device. The bridge forwards pppOE packets between the nas0 and the tap0 devices. The goal is to use a bridged firewall. That means : a FireWall which is not visible from the external network.
Quoted 52 lines
The problem is to be able to filter the pppOE packets that flow across the bridge.
Signature · 9 lines
Francis GASCHET / NUMLOG http://www.numlog.fr Tel.: +33 (0) 130 791 616 Fax.: +33 (0) 130 819 286 Thanks for any help.Quoted 3 lines · SBlaze
You should be able to filter at the "eth0" level of your diagram...
I kinda need more information on your "BRIDGE" before I could suggest
something
Quoted 1 line
else.. If by bridge you mean it bridges the DSL modem and the LAN...then
your
Quoted 26 lines
eth0 is in the same machine you are calling a bridge?
In that case you should theoretically filter the eth0 device
Quoted 18 lines · --- Francis GASCHET
Hi list,
Is there somebody who knows a possibility to apply netfilter rules to ppp packets ?
Configuration :
DSL - PCI modem card - BRIDGE - eth0 (in a virtual machine)
I would like to filter the traffic which flows across the bridge, but at this level, the IP traffic is encapsulated...
Any clue ?
Ciao.
=====
"No touchy NO TOUCHY! Emperor Kuzko -=Emperor's New Groove=-"
__________________________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo
http://search.yahoo.com
Yes, but netfilter looks ignoring these packets.
I sniffed them using ethereal. But I've to set manually the "interface" to nas0. Ethereal doesn't show it in its list. May be something not standard or missing in the eth emulation of this kind of device... But if I enter "nas0" manually in the "interface" ethereal is able to record the data and decodes it.
I think I missed something in iptables working.
I begin to feel that the packets flowing through nas0 disturb iptables because they have a 6+2 bytes pppOE header between Ethernet header and IP header... May be a hack is needed in netfilter / iptables...
Any clue ?
F. GASCHET
Quoted 17 lines · SBlaze
Have you tried filtering on the nas0 device?
Quoted 12 lines · --- Francis GASCHET
Hello,
The bridge we use is the kernel patch provided by http://bridge.sourceforge.net
On the card side, we use Ethernet over ATM bridging (RFC 1483/2684 kernel module). It emulates an "Ethernet like" device : nas0. The pppOE daemon sits in the VM where it reads and writes ppp frames on a virtual eth device created with TAP (http://Vtun.sourceforge.net).
The official address is carried by this virtual eth device.
The bridge forwards pppOE packets between the nas0 and the tap0 devices.
The goal is to use a bridged firewall. That means : a FireWall which is not visible from the external network.The problem is to be able to filter the pppOE packets that flow across the bridge.