Bridging with a Firewall
Regain control over your Layer 2 bridge with iptables and ebtables.
As we saw in the previous hack [Hack #58], creating an Ethernet-to-wireless bridge is very straightforward. While this allows for very easy integration with your existing network, it isn’t always the best decision from a security point of view. Rather than simply connect two networks together at Layer 2, wouldn’t it be nice to be able to tightly control the flow of packets between the two networks?
You might think that you could simply use iptables to control network access, as you normally would with any other network device. In the experimental Linux 2.5 kernels, this is the case. But when 802.1d bridging is in effect in Linux 2.4, the netfilter code never sees bridged packets. In order to make traffic visible to standard firewall tools, you’ll have to patch your kernel.
There are two Linux 2.4 patches available that allow you to manipulate your bridge as a firewall: ebtables and bridge-nf. The first patch implements ebtables, a new packet filter specifically designed for Ethernet bridges. The second provides netfilter functionality for your bridge, so you can manipulate it using iptables. Both patches are available at http://ebtables.sourceforge.net/. While you’re there, be sure to grab a copy of the ebtables utilities as well.
If you’re running Linux 2.5 or later, you’re in luck. Both ebtables and bridge-nf are now built into the kernel, so you don’t have to patch your kernel.