Date: Sat, 19 Nov 2005 23:14:39 +0100 (CET) From: Csaba Urban <ucsaba@freemail.hu> To: Andrew Thompson <thompsa@freebsd.org> Cc: freebsd-net@FreeBSD.org Subject: Re: PF rule on bridged interface won't match Message-ID: <freemail.20051019231439.58673@fm14.freemail.hu> In-Reply-To: <20051119203337.GA804@heff.fud.org.nz>
next in thread | previous in thread | raw e-mail | index | archive | help
The bridge would be a gateway for the hosts which are on member interfaces. I would like to control which IP adresses they can use on a particular interface (i.e. 192.168.1.5 on vlan1, etc.). It seems that it won't work this way. Anyway, it can be done using the old bridge but I think it would be more convenient if packets destined for/ originated from the bridge itself were also handled to pfil_hooks when entering/leaving member interfaces. Andrew Thompson <thompsa@freebsd.org> írta: > On Fri, Nov 18, 2005 at 03:50:42PM +0100, Csaba Urban wrote: > > Hi, > > > > I can't have packets match on PF rules on a member of if_bridge if it is > > not bridged but comes from an other IP interface. Bridged packets > > match correctly. > > > > bridge0: flags=8041<UP,RUNNING,MULTICAST> mtu 1500 > > inet 192.168.1.1 netmask 0xffffffe0 > > ether ac:de:48:af:bc:8f > > priority 32768 hellotime 2 fwddelay 15 maxage 20 > > member: vlan3 flags=3<LEARNING,DISCOVER> > > member: vlan2 flags=3<LEARNING,DISCOVER> > > member: vlan1 flags=3<LEARNING,DISCOVER> > > > > PF rule: > > pass in on vlan1 all > > pass out on vlan1 all > > > > This rule matches only if traffic is bridged (goes directly layer2 from > > vlan1 to vlan2 or vlan3). If it is delivered to the IP layer or it comes from > > there then it won't match. > > This is how its currently implemented. You can match locally generated > packets on the bridge0 interface, is that sufficient for your setup? > > > Andrew > _______________________________________________________________________ Rendelj képet és nyerjél gépet a T-Online Fotótárával december 15-ig. http://www.t-online.hu
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?freemail.20051019231439.58673>