Join Log in
Score:1
Menno avatar Server

How to (properly) configure PPPoE/VLAN decapsulation on Linux bridge?

in flag
Menno

I've been trying to setup a transparent L2 Linux bridging firewall using a Linux bridge in combination with the bridge-nf-call-iptables, bridge-nf-filter-vlan-tagged and bridge-nf-filter-pppoe-tagged system variables.

My configuration:

Bridge:

brctl addif br0 enp1s0
brctl addif br0 enp2s0
ifconfig enp1s0 up
ifconfig enp2s0 up
ifconfig br0 up

Bridge-nf:

/proc/sys/net/bridge/bridge-nf-call-iptables > 1
/proc/sys/net/bridge/bridge-nf-filter-vlan-tagged > 1
/proc/sys/net/bridge/bridge-nf-filter-pppoe-tagged > 1

IPTables:

iptables -A INPUT -d 8.8.8.8 -j DROP
iptables -A FORWARD -d 8.8.8.8 -j DROP

With the above setup, when trying to do a DNS lookup to 8.8.8.8 over a PPPoE encapsulated connection (running through the bridge), nothing gets blocked and the DNS query is succesful. Doing the same query directly (without PPPoE encapsulation) does get properly blocked. So it appears that the packet is not properly decapsulated before being processed by iptables. However, according to the documentation, setting /proc/sys/net/bridge/bridge-nf-filter-pppoe-tagged should enable iptables to filter PPPoE encapsulated packets.

What am I doing wrong/overlooking?

240
0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.