Blame - docs/ebtables-faq.html - external/ebtables

2003-02-08 15:08:34 +0000

[diff] [blame]

1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

2

<HTML>

3

<HEAD>

4

<TITLE>Ebtables (Ethernet Bridge Tables) Frequently Asked

Questions</TITLE>

<META name="description" content=

9

"Ethernet Bridge Tables Frequently Asked Questions">

10

11

<META name="keywords" content=

12

"Linux, netfilter, firewall, bridge, brouter, ebtables, iptables">

13

<META name="keywords" content=

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

14

"FAQ, kernel, ebtables, br-nf, br-nf-bds, ethernet, nat, chains, rules, tables">

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

</HEAD>

<BODY>

<H1>Ebtables (Ethernet Bridge Tables) Frequently Asked Questions</H1>

</DIV>

<H2>Questions</H2>

<OL>

<LI><A href="#quiz0">Intro</A></LI>

24

<LI><A href="#quiz1">Installation</A></LI>

25

<LI><A href="#quiz2">Usage</A></LI>

26

<LI><A href="#quiz3">Other</A></LI>

</OL>

<H2>Answers</H2>

<OL>

<LI>

<B><A name="quiz0">Intro</A></B>

32

<DL>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

33

<DT>What is ebtables?</DT>

34

<DD>The ebtables project is the Linux 2.5.x (and above) Link Layer

35

firewalling subsystem, a patch for 2.4.x is maintained too.

36

It delivers for Linux the functionality of

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

37

Ethernet frame filtering, all kinds of frame NAT (Network Address

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

38

Translation) and frame matching. The ebtables infrastructure is

39

a part of the standard Linux 2.5.x (and above) kernels.</DD>

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

40

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

41

<DD>To filter frames by MAC-address or frame type at

42

Link Layer inside your Linux-based Ethernet bridge, to do

43

some basic filtering of certain protocol headers, to

44

make a Linux brouter.</DD>

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

</DL>

<HR>

</LI>

<LI>

<B><A name="quiz1">Installation</A></B>

51

<DL>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

52

<DT>What should I know before ebtables installation?</DT>

53

<DD>First step is to decide what kernel version to use. If you

54

want to use a 2.5.x (or above) kernel, then just use the latest

55

and greatest kernel version. You won't have to patch the kernel.

56

Check out the submitted kernel patches, available through the

57

58

sourcecode</A> section of the ebtables <A href="http://users.pandora.be/bart.de.schuymer/ebtables">

59

homepage</A> to see if there have been patches applied in later

60

kernel versions than the one you are using.</DD>

61

<DD>If you want to use a 2.4.x kernel, then go to

62

<A href="http://sourceforge.net/projects/ebtables/">Ethernet bridge

63

tables</A> and download the <B>br_nf_bds</B>, <B>ebtables_kernel</B>

64

and <B>ebtables</B> packages. Use the latest packages and use the

65

kernel version for which the kernel patches were made. The

66

<B>ebtables_kernel</B> patch has to be applied before the <B>br_nf_bds</B>

67

kernel patch.</DD>

68

<DT>What is the "ebtables_kernel" package and how do I install it?</DT>

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

69

<DD>

70

The <B>ebtables_kernel</B> package contains a patch against a

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

71

Linux 2.4.x kernel. It allows filtering on the Link Layer (OSI Layer

72

2). It is well-known that iptables works on the Network Layer (OSI

73

Layer 3) and on higher layers. For a bridging firewall it is

74

important to be able to filter on the Link Layer as well.</DD>

75

<DD>Copy the patch file to the kernel source (usually it is named

76

/usr/src/linux or /usr/src/linux-2.X.YZ) and execute the following

77

(use the correct file names and directories where necessary)

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

78

<PRE>

79

# cp ebtables-v2.0.003_vs_2.4.20.diff.gz /usr/src/linux

fnm3

1fadacb

2003-02-18 16:49:43 +0000

[diff] [blame]

80

# cd /usr/src/linux

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

81

# gunzip ebtables-v2.0.003_vs_2.4.20.diff.gz

82

# patch -p1 < ebtables-v2.0.003_vs_2.4.20.diff

83

</PRE>

84

</DD>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

85

<DT>What is the "br-nf-bds" package and how do I install it?</DT>

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

86

<DD>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

87

The <B>br-nf-bds</B> package contains a patch against a Linux

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

88

kernel that is already patched with the <B>ebtables_kernel</B>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

89

patch. It adds the ability of iptables usage on bridge packets to make a

90

bridging firewall. Most work on this patch was done by

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

91

Lennert Buytenhek. The bridge-nf code is automatically compiled

92

into the patched kernel if the bridge and netfilter support is

93

enabled.

94

<PRE>

95

# cp bridge-nf-0.0.10-against-2.4.20.diff.gz /usr/src/linux

fnm3

1fadacb

2003-02-18 16:49:43 +0000

[diff] [blame]

96

# cd /usr/src/linux

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

97

# gunzip bridge-nf-0.0.10-against-2.4.20.diff.gz

98

# patch -p1 < bridge-nf-0.0.10-against-2.4.20.diff

99

</PRE>

100

</DD>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

101

<DT>What is the "ebtables" package and how do I install it?</DT>

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

102

<DD>

103

The <B>ebtables</B> package contains the ebtables userspace

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

104

tool. This ebtables binary is used to make filtering

105

rules for the Linux-based Ethernet bridge. All traffic entering

106

or leaving on a bridge port will be seen by the rules. The ebtables usage is very

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

107

similar to the iptables, so it should not be so hard. Of

108

course, there is a man page supplied. Just gunzip and untar the

109

package and read the INSTALL file.<BR>

<PRE>

# make

</PRE>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

114

Copy the ebtables binary, man page and protocol file to the correct

115

directory (see the INSTALL file for options):

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

<PRE>

# make install

</PRE>

</DD>

</DL>

<HR>

</LI>

<LI>

<B><A name="quiz2">Usage</A></B>

126

<DL>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

127

<DT>Can I filter on ARP packets in the Linux bridge box using

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

128

ebtables?</DT>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

129

<DD>Yes, it's possible to filter on the ARP header, using ebtables.

130

See the <A href="ebtables.8.html">ebtables manual page</A> for

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

131

details.</DD>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

132

<DT>Can I use ebtables with iptables? Are there any problems to

fnm3

e94ebb8

2003-02-18 17:53:43 +0000

[diff] [blame]

133

use it together? How exactly the packet/frame traversing the ebtables/iptables?</DT>

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

134

<DD>Yes, it's possible to use ebtables with iptables. Detailed

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

135

info about ebtables/iptables interaction is explained at the

136

137

"ebtables/iptables interaction on a Linux-based bridge"</A> page.</DD>

138

<DT>Does ebtables keep count statistics?</DT>

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

139

<DD>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

140

Yes, it's possible to view the match and byte count for every rule, using

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

<PRE>

# ebtables -L --Lc

</PRE>

</DD>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

145

<DT>When using the option --Lc, what does the pcnt value represent?</DT>

146

<DD>

147

Normally, pcnt will represent the number of frames that matched this rule. However,

148

if IP connection tracking is enabled, all fragmented IP packets will first be

149

defragmented. Therefore, the pcnt value for IP packets will then represent the

150

number of matched IP packets, not the number of matched frames containing IP fragments.

151

In the BROUTING chain however, pcnt will always represent the number of matched frames, since

152

the IP connection tracking is not done before this chain is traversed.

153

</DD>

154

<DT>What is this brouter stuff and when is it useful?</DT>

155

<DD>

156

The ebtables BROUTING chain gets traversed very early, namely right after a frame

157

is received on a forwarding bridge port. If a rule's decision is to route the frame,

158

the input device will remain the physical device of the bridge port and the bridge

159

code won't touch the frame. The frame will be processed by the network stack. If the

160

decision is to bridge the frame (the default behaviour), then the input device will

161

become the bridge device on which the port is enslaved and the bridge code will decide

162

what to do with the frame.</DD>

163

<DT>So, what's the difference between the ebtables BROUTING and PREROUTING chains?</DT>

164

<DD>The ebtables PREROUTING chain is only traversed when the bridge code is deciding what

165

to do with the frame. So, if a BROUTING chain rule decided the frame should be routed, then

166

the ebtables PREROUTING chain won't see it. See the

167

fnm3

2003-02-18 16:44:07 +0000

[diff] [blame]

168

"ebtables/iptables interaction on a Linux-based bridge"</A> page for the details.</DD>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

169

<DT>I'm using a 2.5.x or higher kernel and my iptables rules won't match on the bridge port

170

devices, what's wrong?</DT>

171

<DD>

172

There is one difference between the br-nf behaviour in the 2.5.x or higher kernels and

173

the 2.4.x patch. To get the br-nf code accepted into the standard 2.5.x kernels, we had to

174

remove the code that automatically checked on the bridge port in the iptables port checking

175

code (options -i and -o). Instead there is now an iptables match module that you have to use

176

to filter on the bridge ports. This kernel module is in the standard 2.5.x kernels and the

177

corresponding userspace module is available in the iptables userspace tool. See the iptables

178

man pages and

179

<PRE>

fnm3

2003-02-18 16:44:07 +0000

[diff] [blame]

180

# iptables -m physdev -h

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

181

</PRE>

182

The kernel module has to be compiled in the kernel, the option ``physdev match support'' will

183

appear under the ``IP netfilter configuration'' when the bridge is already enabled in the

184

configuration.

185

</DD>

186

<DT>I want to use the most recent ebtables code, even if it's not yet in an official release.

187

How do I do this?</DT>

188

<DD>

189

The most recent code is available at the <A href="http://sourceforge.net/projects/ebtables">

190

sourceforge ebtables</A> CVS repository. To get a copy of the repository, do the following:

191

<PRE>

fnm3

2003-02-18 16:44:07 +0000

[diff] [blame]

192

# cvs -d:pserver:anonymous@cvs.sourceforge.net:/cvsroot/ebtables login

193

# cvs -z3 -d:pserver:anonymous@cvs.sourceforge.net:/cvsroot/ebtables co ebtables2

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

194

</PRE>

195

The current userspace code is in the ebtables2/userspace/ebtables2 directory. To compile the

196

CVS userspace tool you'll need to do the following:

197

<PRE>

Bart De Schuymer

6c97d52

2003-02-19 20:09:51 +0000

[diff] [blame]

198

# make KERNEL_INCLUDES=/usr/src/linux/include/

fnm3

2003-02-18 16:44:07 +0000

[diff] [blame]

199

# make install

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

200

</PRE>

201

Obviously you'll need to use the right kernel directory. Why is compiling the CVS different?

202

Because the kernel include files are not maintained in the userspace directory of the CVS.

203

When a new ebtables release is made, the kernel include files get copied in the tar file, so

204

the standard installation knows where to get its kernel include files.</DD>

205

<DD>To copy the ebtables kernel 2.4.x code to a full 2.4.x kernel tree, use this script:

206

<PRE>

207

ebtables2/kernel/scripts/CopyRep

208

</PRE>

209

To copy the ebtables kernel 2.5.x code to a full 2.5.x kernel tree, use this script:

210

<PRE>

211

ebtables2/kernel/scripts/CopyRep2.5

212

</PRE>

213

You'll need to adjust the variables $FROM and $TO in the script, for more information: read the

214

script.</DD>

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

</DL>

<BR>

<HR>

</LI>

<LI>

<B><A name="quiz3">Other</A></B><BR>

222

<DL>

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

223

<DT>I'm not a Linux system's programmer, but I need a feature, which

224

is not (yet) implemented in ebtables. What should I do?</DT>

225

<DD>Subscribe to the <A href= "https://lists.sourceforge.net/lists/listinfo/ebtables-user">

226

ebtables users mailing list</A>. Then post a short and clean description of

227

your wanted feature to this mailing list.</DD>

228

<DT>I'm a C programmer and I want to add an ebtables feature by

229

myself. Where should I begin?</DT>

fnm3

2003-02-08 15:08:34 +0000

[diff] [blame]

230

<DD>Subscribe to the <A href=

231

"https://lists.sourceforge.net/lists/listinfo/ebtables-devel">ebtables

Bart De Schuymer

2003-02-15 13:47:40 +0000

[diff] [blame]

232

developers mail list</A>. Read the <A href=

233

"ebtables-hacking-HOWTO.html">"Ebtables Hacking HOWTO"</A> and

234

have a look at the already implemented modules. You will find that

235

adding a module is not very hard. Additional information is available

236

at the ebtables <A href="http://users.pandora.be/bart.de.schuymer/ebtables">

237

homepage</A>.</DD>

fnm3