Re: Quick bridging question

[Jason Wright <jason@thought.net>]

On Thu, Mar 01, 2001 at 02:56:44PM -0600, Claus wrote:
> Thanks Jason that help a lot.
> 
> Now I'm wondering what happens if I ssh to the internal interface (A) from 
> my interface, does that leak to the internet.  And what about when I ssh 
> from the internet to my internal interface (A), does that leak to the local 
> lan?
> 
No.  This was a bit of a trick to make it work, but the bridge code
examines incoming frames and those that have a destination address
that is multicast, broadcast, or matches the MAC address of one of
the bridge members, it will be passed down to the IP stack of the
bridge machine and treated as if the bridge was not there.  (Multicast
and broadcast destination packets will -also- be forwarded to all
interfaces by the bridge code).  Bottom line, there is no leakage
from one side to the other when you are talking IP to the bridge
machine itself.

> I'm wondering about this because I found out that ipf.rules such as "block 
> in quick on B from any to any" doesn't have any effect since the 
> connections to the internal interface's IP number appear as if they came 
> from the internal interface instead of the external one.

You're seeing the vestiges of a trick in the bridge.  Say you receive a
packet on (A) with the destination MAC address of (B), the bridge will,
after finding the destination MAC matches (B), make the packet appear
to have come in on (B) for the IP stack's processing.  This trick allows
several things to work with the bridge, and appears to generate least
surprise behavior in many cases.

--Jason L. Wright