Skip to Main Content
Wireless Hacks
book

Wireless Hacks

by Rob Flickenger
September 2003
Intermediate to advanced content levelIntermediate to advanced
304 pages
8h 39m
English
O'Reilly Media, Inc.
Content preview from Wireless Hacks

Bridging with a Firewall

Regain control over your Layer 2 bridge with iptables and ebtables.

As we saw in the previous hack [Hack #58], creating an Ethernet-to-wireless bridge is very straightforward. While this allows for very easy integration with your existing network, it isn’t always the best decision from a security point of view. Rather than simply connect two networks together at Layer 2, wouldn’t it be nice to be able to tightly control the flow of packets between the two networks?

You might think that you could simply use iptables to control network access, as you normally would with any other network device. In the experimental Linux 2.5 kernels, this is the case. But when 802.1d bridging is in effect in Linux 2.4, the netfilter code never sees bridged packets. In order to make traffic visible to standard firewall tools, you’ll have to patch your kernel.

There are two Linux 2.4 patches available that allow you to manipulate your bridge as a firewall: ebtables and bridge-nf. The first patch implements ebtables, a new packet filter specifically designed for Ethernet bridges. The second provides netfilter functionality for your bridge, so you can manipulate it using iptables. Both patches are available at http://ebtables.sourceforge.net/. While you’re there, be sure to grab a copy of the ebtables utilities as well.

If you’re running Linux 2.5 or later, you’re in luck. Both ebtables and bridge-nf are now built into the kernel, so you don’t have to patch your kernel.

Patching ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Maximum Wireless Security

Maximum Wireless Security

Cyrus Peikari, Seth Fogie
Real Time Over Wireless

Real Time Over Wireless

Jerome Henry / Rob Barton
Troubleshooting Linux® Firewalls

Troubleshooting Linux® Firewalls

Michael Shinn, Scott Shinn

Publisher Resources

ISBN: 0596005598Catalog PageErrata