Re: Quick bridging question

[Claus <cniesen@gmx.net>]

At 04:24 PM 03/01/2001, Jason Wright wrote:
>On Thu, Mar 01, 2001 at 02:56:44PM -0600, Claus wrote:
> > Thanks Jason that help a lot.
> >
> > Now I'm wondering what happens if I ssh to the internal interface (A) from
> > my interface, does that leak to the internet.  And what about when I ssh
> > from the internet to my internal interface (A), does that leak to the 
> local
> > lan?
> >
>No.  This was a bit of a trick to make it work, but the bridge code
>examines incoming frames and those that have a destination address
>that is multicast, broadcast, or matches the MAC address of one of
>the bridge members, it will be passed down to the IP stack of the
>bridge machine and treated as if the bridge was not there.  (Multicast
>and broadcast destination packets will -also- be forwarded to all
>interfaces by the bridge code).  Bottom line, there is no leakage
> >from one side to the other when you are talking IP to the bridge
>machine itself.

Aha, now I understand how things work.  This definitely makes my life a lot 
easier. From all the things that you know you must have written the bridge 
part.  A quick glance in the man pages confirms this.

> > I'm wondering about this because I found out that ipf.rules such as "block
> > in quick on B from any to any" doesn't have any effect since the
> > connections to the internal interface's IP number appear as if they came
> > from the internal interface instead of the external one.
>
>You're seeing the vestiges of a trick in the bridge.  Say you receive a
>packet on (A) with the destination MAC address of (B), the bridge will,
>after finding the destination MAC matches (B), make the packet appear
>to have come in on (B) for the IP stack's processing.  This trick allows
>several things to work with the bridge, and appears to generate least
>surprise behavior in many cases.
>
>--Jason L. Wright

The trick did cause me a problem since my ipf rules where blocking the 
incoming connection on the external port, even for services such as SSH 
that where listening on the internal interface of the fire wall.  So it 
kind of messes with the way ipf would normally work.  Maybe a note should 
be put into the FAQ regarding this.

Again thanks for all the help.  Where should I send the donuts?
   Claus