Op wo, 23-02-2005 te 08:22 -0600, schreef Michael L Owen:
> 2) Add Squid as transparent Proxy (Accomplished, sort of).
>
> With Squid in Transparent mode, all http requests are picked up by the
> bridge device, and processed. All ebtables and iptables tables are in ACCEPT
> mode (i.e. no rules in place yet). The problem at this point is that the
> Squid responds to both sides of the bridge, and I need to limit all services
> to the downstream side while allowing things like NetBIOS to be bridged. I
> assume that this can be done with a combination of ebtable and iptable
> rules, but I have been unable to find any viable examples so far. I'm
> somewhat confused regarding the proper setup of the bridge for this as some
> examples show a bridge(br0) with an IP assigned and two slave devices (eth0
> and eth1) with no Ip's, while others show br0 with no IP and each slave
> device with different two contiguous IP's assigned(like a 4-node subnet).
What exactly do you want? If you want to drop all IP traffic destined to
the bridge that arrived on a certain bridge port (say, eth0), just do
ebtables -A INPUT -i eth0 -j DROP
If you want the bridge to act as a router too, in such a way that one
side of the bridge has a different IP range than the other side of the
bridge, then it is best to implement a brouter because you can then
assign an IP address of the right range to both bridge ports, see the
examples page.
If you don't need 2 IP addresses for the bridge, then you don't need a
brouter.
cheers,
Bart
|