Confused about bridging, firewall (iptables), and DHCP

[Tony Nelson]

At 12:22 PM -0500 3/14/07, Mikkel L. Ellertson wrote:
>Tony Nelson wrote:
>> At 3:16 PM +1030 3/14/07, Tim wrote:
>>> On Tue, 2007-03-13 at 22:28 -0400, Tony Nelson wrote:
>>>> I'm reading Rusty Russell's Linux iptables HOWTO now.  Section 5 says
>>>> it works on IPs, not on interfaces.
>>> You can make rules that refer to interfaces.  They're useful when you
>>> want to simply trust/distrust anything on it, or the addresses for it
>>> are changeable.
>>>
>>> A rule for any incoming ethernet interface:
>>> iptables --append INPUT --jump DROP --protocol tcp --in-interface eth+
>>>
>>> A rule for any incoming eth1 interface:
>>> iptables --append INPUT --jump DROP --protocol tcp--in-interface eth1
>>
>> Note that these rules affect only packets addressed to an IP of this box,
>> and won't affect packets to other IPs, which will use the FORWARD chain,
>> according to Rusty's iptables HOWTO and my experiments.  Traffic from my
>> box's IP to the VM's IP goes through the OUTPUT chain (which by default has
>> no rules), and traffic the other way goes through the INPUT chain.  IIUC,
>> traffic from the world to the VM's IP should go through the FORWARD chain
>> either way, and doesn't use the INPUT or OUTPUT chains, and the counter I
>> put on FORWARD seems to agree.
>>
>>     /sbin/iptables -F FORWARD
>>     /sbin/iptables -A FORWARD -j ACCEPT
>
>Unless this bridge is set up different then what is described in the
> bridge-utils documentation, you should not need any forwarding
>rules between eth0 and tap0. ...
 ...

The ACCEPT rule simply mimics the default for the FORWARD chain, so it
doesn't have any effect... or does it?  Yes, with that rule in place,
"iptables -vL" will show how much traffic has been forwarded.
-- 
____________________________________________________________________
TonyN.:'                       <mailto:tonynelson at georgeanelson.com>
      '                              <http://www.georgeanelson.com/>