Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4138 > unrolled thread

Separate two network bridges on linux

Back to article view | Back to comp.os.linux.networking

Contents

  Separate two network bridges on linux Kevin Osthoff <icepic1984@gmx.de> - 2018-06-21 22:11 +0200
    Re: Separate two network bridges on linux Grant Taylor <gtaylor@tnetconsulting.net> - 2018-06-21 12:30 -0600
      Re: Separate two network bridges on linux Kevin Osthoff <icepic1984@gmx.de> - 2018-06-21 23:52 +0200
        Re: Separate two network bridges on linux Grant Taylor <gtaylor@tnetconsulting.net> - 2018-06-21 16:37 -0600
        Re: Separate two network bridges on linux Pascal Hambourg <pascal@plouf.fr.eu.org> - 2018-06-22 21:27 +0200
          Re: Separate two network bridges on linux Kevin Osthoff <icepic1984@gmx.de> - 2018-06-23 00:16 +0200
    Re: Separate two network bridges on linux Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-06-21 19:36 +0000
      Re: Separate two network bridges on linux Kevin Osthoff <icepic1984@gmx.de> - 2018-06-21 23:59 +0200
        Re: Separate two network bridges on linux Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-06-21 20:39 +0000
        Re: Separate two network bridges on linux Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-06-22 11:14 +0300
          Re: Separate two network bridges on linux Kevin Osthoff <icepic1984@gmx.de> - 2018-06-22 20:18 +0200
            Re: Separate two network bridges on linux Grant Taylor <gtaylor@tnetconsulting.net> - 2018-06-22 12:35 -0600
              Re: Separate two network bridges on linux Kevin Osthoff <icepic1984@gmx.de> - 2018-06-23 00:10 +0200
                Re: Separate two network bridges on linux Grant Taylor <gtaylor@tnetconsulting.net> - 2018-06-22 14:36 -0600
                  Re: Separate two network bridges on linux Richard Kettlewell <invalid@invalid.invalid> - 2018-06-22 22:23 +0100
                    Re: Separate two network bridges on linux Grant Taylor <gtaylor@tnetconsulting.net> - 2018-06-22 15:37 -0600
                Re: Separate two network bridges on linux Grant Taylor <gtaylor@tnetconsulting.net> - 2018-06-22 15:46 -0600
                Re: Separate two network bridges on linux Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-06-22 22:45 +0000
                  Re: Separate two network bridges on linux Grant Taylor <gtaylor@tnetconsulting.net> - 2018-06-22 17:38 -0600
      Re: Separate two network bridges on linux Grant Taylor <gtaylor@tnetconsulting.net> - 2018-06-21 16:40 -0600
        Re: Separate two network bridges on linux Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-06-22 05:38 +0000
      Re: Separate two network bridges on linux Stefan Monnier <monnier@iro.umontreal.ca> - 2018-06-21 22:01 -0400
        Re: Separate two network bridges on linux Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-06-22 05:54 +0000
          Re: Separate two network bridges on linux Grant Taylor <gtaylor@tnetconsulting.net> - 2018-06-22 13:40 -0600
            Re: Separate two network bridges on linux Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-06-23 06:36 +0000
            Re: Separate two network bridges on linux Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2018-06-23 20:18 +0300

Page 1 of 2  [1] 2  Next page →

#4138 — Separate two network bridges on linux

Hi!

I am currently trying to setup a router for my homenetwork using linux
(Archlinux to be more specific). The embedded board i am using has 3 lan
interfaces, called wan0, lan0, lan1 and two wifi cards, called wifi0 and
wifi1. I want to have two separate networks, one for my guests and for
my family and me. My current setup looks like this :

>     +-------+
>     | wifi0 +----------------+
>     +-------+           +----+---+
>                         |  brg0  |
>     +-------+           +----+---+
>     | eth0  +----------------+
>     +-------+
      
      
>     +-------+
>     | wifi1 +----------------+
>     +-------+           +----+---+
>                         |  brg1  |
>     +-------+           +----+---+
>     | eth1  +----------------+
>     +-------+

I configured a bridge containing lan0 and wifi0, called brd0, with ip
address 192.168.10.1/24 and a bridge containing lan1 and wifi1, called
brd1, with ip address 192.168.20.1/24. On brd0 as well as brd1 dnsmasq
is running in dhcpd mode to propagate ip addresses to clients in the
range 192.168.10.50-125 for brd0 and range 192.168.20.50-125 for
brd1. The 192.168.20.1/24 network is my guest network, while
192.168.10.1/24 is my home network.

This setup works so far. However, one thing took me by surprise. I
though, because guest and home network are in two different subnets the
traffic between them is also separated. However, when i am connect to
the guest network i can also reach services and computers on the home
network, even though no static router or forwarding is set. ( the other
way around is also true). I guess this has something to do how bridge
devices work under linux.

My question is, why does this happen, how to configure the router so
that both networks are separated form each other? Do I need to use
traffic filter rules? Can this be implemented with etables? Or is my
setup somehow broken and it should not be possible to reach service from
one network to the other?

-- 
No fun. Not ever!

[toc] | [next] | [standalone]

#4139

On 06/21/2018 02:11 PM, Kevin Osthoff wrote:
> Hi!

Hi,

> I am currently trying to setup a router for my homenetwork using linux 
> (Archlinux to be more specific). The embedded board i am using has 3 
> lan interfaces, called wan0, lan0, lan1 and two wifi cards, called wifi0 
> and wifi1. I want to have two separate networks, one for my guests and 
> for my family and me. My current setup looks like this :
> 
>      +-------+
>      | wifi0 +----------------+
>      +-------+           +----+---+
>                          |  brg0  |
>      +-------+           +----+---+
>      | eth0  +----------------+
>      +-------+
>        
>        
>      +-------+
>      | wifi1 +----------------+
>      +-------+           +----+---+
>                          |  brg1  |
>      +-------+           +----+---+
>      | eth1  +----------------+
>      +-------+
> 
> I configured a bridge containing lan0 and wifi0, called brd0, with ip 
> address 192.168.10.1/24 and a bridge containing lan1 and wifi1, called 
> brd1, with ip address 192.168.20.1/24. On brd0 as well as brd1 dnsmasq is 
> running in dhcpd mode to propagate ip addresses to clients in the range 
> 192.168.10.50-125 for brd0 and range 192.168.20.50-125 for brd1. The 
> 192.168.20.1/24 network is my guest network, while 192.168.10.1/24 is 
> my home network.

That all seems simple enough.  I've done similar myself a number of times.

> This setup works so far. However, one thing took me by surprise. I though, 
> because guest and home network are in two different subnets the traffic 
> between them is also separated. However, when i am connect to the guest 
> network i can also reach services and computers on the home network, 
> even though no static router or forwarding is set. ( the other way around 
> is also true). I guess this has something to do how bridge devices work 
> under linux.

I don't think this has anything to do with bridging.

It also sounds like devices on lan0 (eth0) and wifi0 use brg0 as their 
default gateway.  Similarly devices on lan1 (eth1) and wifi1 use brg1 as 
their default gateway.  So client devices are using their default 
gateway to get to where ever they want to go, even if that's the other 
network.

Linux has routes to networks on brg0 and brg1 as directly attached.  I'm 
guessing it also has an internet connection and a default route.  The 
point being that Linux as the (assumed) default gateway for each network 
is dutifully routing traffic between the networks.

> My question is, why does this happen, how to configure the router so 
> that both networks are separated form each other? Do I need to use 
> traffic filter rules? Can this be implemented with etables? Or is my 
> setup somehow broken and it should not be possible to reach service from 
> one network to the other?

Aside:  You indicate this is a router.  So I'm assuming that it is 
routing the two (W)LANs to / from the Internet.

The first thing that comes to mind is if you aren't blocking 
(firewalling) traffic between brg0 and brg1.

Linux routing (by default) does not do any filtering.  A Linux router 
will (by default) route a packet to any destination if it has a route to 
it.  You have to actively stop it from doing so if you want the traffic 
to not flow.

I'd suggest ip(6)tables.  You can also use different routing tables for 
brg0 and brg1 such that each only knows about it's network and the 
Internet, thereby not having a route to the other network.

Yes, you will need to implement traffic filtering in some way.

I don't think you need ebtables as you're not needing to filter at the 
L2 / bridge level.

I think you do need to use ip(6)tables to filter at the L3 / routing level.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4141

Grant Taylor <gtaylor@tnetconsulting.net> writes:

> Hi,

Hi Grant!

> I don't think this has anything to do with bridging.
>
> It also sounds like devices on lan0 (eth0) and wifi0 use brg0 as their
> default gateway.  Similarly devices on lan1 (eth1) and wifi1 use brg1
> as their default gateway.  So client devices are using their default
> gateway to get to where ever they want to go, even if that's the other
> network.
>
> Linux has routes to networks on brg0 and brg1 as directly attached.
> I'm guessing it also has an internet connection and a default route.
> The point being that Linux as the (assumed) default gateway for each
> network is dutifully routing traffic between the networks.
>
>> My question is, why does this happen, how to configure the router so
>> that both networks are separated form each other? Do I need to use
>> traffic filter rules? Can this be implemented with etables? Or is my
>> setup somehow broken and it should not be possible to reach service
>> from one network to the other?
>
> Aside:  You indicate this is a router.  So I'm assuming that it is
> routing the two (W)LANs to / from the Internet.

I guess i need to be more specific here. I want to build a router and by
this i mean, that packages from network connected on brg0 and brg1 will
be forwarded to the internet. The connection to the internet will be
established via ppoe over wan0. But currently i am trying to setup the
basic configuration of the network, so lets ignore internet and traffic
filtering moment.

Lets simplify my setup even more and lets remove the bridges and only
look at the interfaces lan0/eth0 and lan1/eth1 (i renamed eth0 and eth1
to lan0/lan1 in my setup). Using the same setup as described in my
previous post, lan0 will have ip address 192.168.10.1/24 and lan1 will
have ip 192.168.20.1/24. Another pc connected to lan0, which is in the
same subnet (192.168.10.2) cannot ping 192.168.20.1. This is at least
my expectation and i verified my expectation by trying this out. But as
soon as i bridge the interfaces, a ping from subnet 192.168.10.1/24 to
192.168.20.1 is possible, even though the bridges don't know each other.

This is what confuse me.

-- 
No fun. Not ever!

[toc] | [prev] | [next] | [standalone]

#4144

On 06/21/2018 03:52 PM, Kevin Osthoff wrote:
> Hi Grant!

Hi Kevin,

> I guess i need to be more specific here. I want to build a router and 
> by this i mean, that packages from network connected on brg0 and brg1 
> will be forwarded to the internet.

Okay.  That should be perfectly doable.

> The connection to the internet will be established via ppoe over wan0. But 
> currently i am trying to setup the basic configuration of the network, 
> so lets ignore internet and traffic filtering moment.

Okay.

wan0 is a new interface that you didn't mention the first time around. 
But we're ignoring it for the time being.  ;-)

> Lets simplify my setup even more and lets remove the bridges and only 
> look at the interfaces lan0/eth0 and lan1/eth1

Sure.

> (i renamed eth0 and eth1 to lan0/lan1 in my setup).

Not a problem.  Thank you for clarifying.

> Using the same setup as described in my previous post, lan0 will have ip 
> address 192.168.10.1/24 and lan1 will have ip 192.168.20.1/24. Another 
> pc connected to lan0, which is in the same subnet (192.168.10.2) cannot 
> ping 192.168.20.1.

Okay.  No problem.  Perfectly doable.

> This is at least my expectation and i verified my expectation by trying 
> this out. But as soon as i bridge the interfaces, a ping from subnet 
> 192.168.10.1/24 to 192.168.20.1 is possible, even though the bridges 
> don't know each other.

Okay.  I immediately suspect the ip(6)tables firewall that's obviously 
doing the filtering between the lan0 and lan1 interfaces.

It's entirely possible to write ip(6)tables firewall rules such that it 
explicitly blocks some traffic and allows other traffic by default. 
(This is the iptables "POLICY" option for built in chains.)  It's also 
possible to write ip(6)tables firewall rules such that they explicitly 
allow some traffic and block other traffic by default.

It sounds like your ip(6)tables firewall is the former and was matching 
the interfaces to block.  So when you changed to the bridge interfaces 
the firewall now no longer matched and blocked the traffic.

This is also why I prefer the second method.

Can I see the output of iptables-save?

> This is what confuse me.

This really sounds like it's related to the ip(6)tables firewall.

Note:  I believe that you could substitute nftables in place of iptables 
in this email and the same thing would apply.  I'm not sure what your 
system is using.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4152

Le 21/06/2018 à 23:52, Kevin Osthoff a écrit :
> 
> I guess i need to be more specific here.

Yes you do. Specifically, you need to post FACTS, not your 
interpretation of them.

This includes the output of the following command in both setups, with 
an without bridge :

On the router :
ip addr
ip route
ip rule
iptables-save
brctl show
ebtables -Lx
sysctl net.ipv4 | egrep "(\.|ip_)forward"

On hosts in both networks :
ip addr
ip route

> Lets simplify my setup even more and lets remove the bridges and only
> look at the interfaces lan0/eth0 and lan1/eth1 (i renamed eth0 and eth1
> to lan0/lan1 in my setup). Using the same setup as described in my
> previous post, lan0 will have ip address 192.168.10.1/24 and lan1 will
> have ip 192.168.20.1/24. Another pc connected to lan0, which is in the
> same subnet (192.168.10.2) cannot ping 192.168.20.1.

Please post FACTS : what command do you run, what output do you get ?

> This is at least
> my expectation and i verified my expectation by trying this out. But as
> soon as i bridge the interfaces, a ping from subnet 192.168.10.1/24 to
> 192.168.20.1 is possible, even though the bridges don't know each other.

[toc] | [prev] | [next] | [standalone]

#4155

Pascal Hambourg <pascal@plouf.fr.eu.org> writes:

> Yes you do. Specifically, you need to post FACTS, not your
> interpretation of them.
>
> This includes the output of the following command in both setups, with
> an without bridge :
>
> On the router :
> ip addr
> ip route
> ip rule
> iptables-save
> brctl show
> ebtables -Lx
> sysctl net.ipv4 | egrep "(\.|ip_)forward"
>
> On hosts in both networks :
> ip addr
> ip route

Hi Pascal!

Yes, you are right. Will post the output tomorrow.

Best regards

Kevin

-- 
No fun. Not ever!

[toc] | [prev] | [next] | [standalone]

#4140

On Thu, 2018-06-21, Kevin Osthoff wrote:
> Hi!
>
> I am currently trying to setup a router for my homenetwork using linux
> (Archlinux to be more specific). The embedded board i am using has 3 lan
> interfaces, called wan0, lan0, lan1 and two wifi cards, called wifi0 and
> wifi1. I want to have two separate networks, one for my guests and for
> my family and me. My current setup looks like this :
...
>
> I configured a bridge containing lan0 and wifi0, called brd0, with ip
> address 192.168.10.1/24 and a bridge containing lan1 and wifi1, called
> brd1, with ip address 192.168.20.1/24. On brd0 as well as brd1 dnsmasq
> is running in dhcpd mode to propagate ip addresses to clients in the
> range 192.168.10.50-125 for brd0 and range 192.168.20.50-125 for
> brd1. The 192.168.20.1/24 network is my guest network, while
> 192.168.10.1/24 is my home network.

Doesn't answer your question, but:

Why not do it the straightforward way -- just a router with
three networks attached, and NATing against the internet on
a fourth interface?

     +-----+
world|     +---- 196.168.1/24 ethernet
-----+     +---- 196.168.2/24 wifi
     |     +---- 196.168.3/24 guest wifi
     +-----+

That would make it easier to reason about.

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#4142

Jorgen Grahn <grahn+nntp@snipabacken.se> writes:

> Doesn't answer your question, but:
>
> Why not do it the straightforward way -- just a router with
> three networks attached, and NATing against the internet on
> a fourth interface?
>
>      +-----+
> world|     +---- 196.168.1/24 ethernet
> -----+     +---- 196.168.2/24 wifi
>      |     +---- 196.168.3/24 guest wifi
>      +-----+
>
> That would make it easier to reason about.

Yes, for sure. This is the setup i run on my current system. Maybe i am
overcomplicating things. But now i want to know why my approach does not
work. I think my understanding of networks is flawed, but where is the
error?

> /Jorgen

Best regards

Kevin
-- 
No fun. Not ever!

[toc] | [prev] | [next] | [standalone]

#4143

On Thu, 2018-06-21, Kevin Osthoff wrote:
> Jorgen Grahn <grahn+nntp@snipabacken.se> writes:
>
>> Doesn't answer your question, but:
>>
>> Why not do it the straightforward way -- just a router with
>> three networks attached, and NATing against the internet on
>> a fourth interface?
>>
>>      +-----+
>> world|     +---- 196.168.1/24 ethernet
>> -----+     +---- 196.168.2/24 wifi
>>      |     +---- 196.168.3/24 guest wifi
>>      +-----+
>>
>> That would make it easier to reason about.
>
> Yes, for sure. This is the setup i run on my current system. Maybe i am
> overcomplicating things. But now i want to know why my approach does not
> work. I think my understanding of networks is flawed, but where is the
> error?

Ok; thanks.  I was partly asking because I wondered if I had missed a
requirement you had, which explained your setup.

I haven't had reason to use the extra technologies you listed, so I cannot
help; sorry.  (But it seems other can.)

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#4149

On 22.6.18 00:59, Kevin Osthoff wrote:
> Jorgen Grahn <grahn+nntp@snipabacken.se> writes:
> 
>> Doesn't answer your question, but:
>>
>> Why not do it the straightforward way -- just a router with
>> three networks attached, and NATing against the internet on
>> a fourth interface?
>>
>>       +-----+
>> world|     +---- 196.168.1/24 ethernet
>> -----+     +---- 196.168.2/24 wifi
>>       |     +---- 196.168.3/24 guest wifi
>>       +-----+
>>
>> That would make it easier to reason about.
> 
> Yes, for sure. This is the setup i run on my current system. Maybe i am
> overcomplicating things. But now i want to know why my approach does not
> work. I think my understanding of networks is flawed, but where is the
> error?
> 
>> /Jorgen
> 
> Best regards
> 
> Kevin


The point is pretty simple: Unless you use the iptables to
prevent it, the kernel takes a packet coming from 192.168.20.x
and forwards it to 192.168.10.y if it is addressed to go there,
and the same for return packets.

To separate the networks, you need two rules in iptables:
  packets from 192.168.20.0/24 to 192.168.10.0/24 dropped,
  packets from 192.168.10.1/24 to 192.168.20.0/24 dropped.

-- 

-TV

[toc] | [prev] | [next] | [standalone]

#4150

Tauno Voipio <tauno.voipio@notused.fi.invalid> writes:

> The point is pretty simple: Unless you use the iptables to
> prevent it, the kernel takes a packet coming from 192.168.20.x
> and forwards it to 192.168.10.y if it is addressed to go there,
> and the same for return packets.

Ok i think that is the point. If i use real hardware interface
(eth0/lan0 and eht1/lan1) the kernel don't forward packages between
them? But if i use bridges, packages are forward between bridges even
though they bridge different interface (brdg0 bridges lan0/wifi0 and
brdg1 lan1/wifi1)? Is this correct? If so, why is this implemented this
way? Or does the kernel always forward packages between interface?

Sorry for the confusion. I guess i didn't articulate my problem in an
adequate way. But English is not my first language, so i am struggling
here :)

I know how setup the filter rules. But i had the opinion, that filtering
is not necessary between 192.168.20/10 because i have two independent
networks. 

> To separate the networks, you need two rules in iptables:
>  packets from 192.168.20.0/24 to 192.168.10.0/24 dropped,
>  packets from 192.168.10.1/24 to 192.168.20.0/24 dropped.

Best regards

Kevin
-- 
No fun. Not ever!

[toc] | [prev] | [next] | [standalone]

#4151

On 06/22/2018 12:18 PM, Kevin Osthoff wrote:
> Ok i think that is the point. If i use real hardware interface (eth0/lan0 
> and eht1/lan1) the kernel don't forward packages between them?

That's just it.  The kernel does forward packets between interfaces 
unless you expressly stop it.

I'm guessing that you have something in iptables that is stopping 
between physical interfaces and don't have the corresponding to stop 
between logical (bridge) interfaces.

> But if i use bridges, packages are forward between bridges even though 
> they bridge different interface (brdg0 bridges lan0/wifi0 and brdg1 
> lan1/wifi1)?

Bridge logical interfaces should behave the same way as physical 
interfaces (in this context).  Both physical and logical need something 
to stop traffic from being forwarded.

> Is this correct?

I think that it's incorrect.

> If so, why is this implemented this way? Or does the kernel always 
> forward packages between interface?

The kernel always forwards packets between interfaces unless you do 
something to stop it.

> Sorry for the confusion. I guess i didn't articulate my problem in an 
> adequate way. But English is not my first language, so i am struggling 
> here :)

I think you did fine.

> I know how setup the filter rules. But i had the opinion, that filtering 
> is not necessary between 192.168.20/10 because i have two independent 
> networks.

Filtering is necessary.  The kernel has routes to both networks.  So any 
traffic that comes into the kernel is routed to where it needs to go, be 
it the other network or the Internet.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4154

Grant Taylor <gtaylor@tnetconsulting.net> writes:

> That's just it.  The kernel does forward packets between interfaces
> unless you expressly stop it.
>
> [...]
> 
> Bridge logical interfaces should behave the same way as physical
> interfaces (in this context).  Both physical and logical need
> something to stop traffic from being forwarded.

Ok thanks for the clearification. Do different unix operating systems
behave differently regarding this aspect? Is this what is called strong
/ weak host model? 

> Filtering is necessary.  The kernel has routes to both networks.  So
> any traffic that comes into the kernel is routed to where it needs to
> go, be it the other network or the Internet.

Ok i will setup filter rules. Thanks for your help.

Best regard

Kevin!

-- 
No fun. Not ever!

[toc] | [prev] | [next] | [standalone]

#4156

On 06/22/2018 04:10 PM, Kevin Osthoff wrote:
> Ok thanks for the clearification.

You're welcome.

> Do different unix operating systems behave differently regarding this 
> aspect?

Different operating systems (Unix, Linux, FreeBSD, Solaris, etc) have 
different behaviors and networking capabilities.

I would expect most Linux distributions to have similar capabilities, 
some depending on features in the kernel.  Some distributions may use 
different configurations of said features.

> Is this what is called strong / weak host model?

I don't recognize that phrase.  As such I can't say one way or the other.

> Ok i will setup filter rules.

I would want to find out what rules are blocking it between the physical 
NICs and see if that can be modified to work with the logical bridges.

I personally prefer to block everything and explicitly allow just the 
things that I want to be allowed through.

> Thanks for your help.

You're welcome.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4157

Grant Taylor <gtaylor@tnetconsulting.net> writes:
> On 06/22/2018 04:10 PM, Kevin Osthoff wrote:
>> Is this what is called strong / weak host model?

No.

> I don't recognize that phrase.  As such I can't say one way or the
> other.

https://tools.ietf.org/html/rfc1122#page-61 s3.3.4.2 

-- 
https://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#4158

On 06/22/2018 03:23 PM, Richard Kettlewell wrote:
> https://tools.ietf.org/html/rfc1122#page-61 s3.3.4.2

Thank you for the assist Richard.  :-)



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4159

On 06/22/2018 04:10 PM, Kevin Osthoff wrote:
> Is this what is called strong / weak host model?

No, I would not consider this to be related to strong or weak host (End 
System) model

Linux does tend to use the weak host model.  But I think that is 
unrelated to the question you asked and the issue that you're working on 
that prompted you to ask.

I say Linux uses the weak host model because traffic coming in any 
interface destined to a local IP is processed, even if the destination 
IP is on a different interface than the one that it came in.

RFC 1122 - Requirements for Internet Hosts § 3.3.4.4 states the following:

> (A)  A host MAY silently discard an incoming datagram whose destination 
> address does not correspond to the physical interface through which it 
> is received.

If we substitute "MUST NOT" for "MAY", we see that Linux upholds the 
Weak AS Model and violates the Strong ES Model.

That being said, Linux can be tuned to come much closer to the Strong ES 
Model.

I personally think of / design with Linux networking in the Strong ES 
model.  I occasionally, but rarely, get burned by this.

Thank you again for the assist and pointer to RFC 1122 - Requirements 
for Internet Hosts § 3.3.4.4 Richard.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4160

On Fri, 2018-06-22, Kevin Osthoff wrote:
> Grant Taylor <gtaylor@tnetconsulting.net> writes:
>
>> That's just it.  The kernel does forward packets between interfaces
>> unless you expressly stop it.
>>
>> [...]
>> 
>> Bridge logical interfaces should behave the same way as physical
>> interfaces (in this context).  Both physical and logical need
>> something to stop traffic from being forwarded.
>
> Ok thanks for the clearification. Do different unix operating systems
> behave differently regarding this aspect?

Look at it a different way, and it may be easier to see.  It's a
/router/: routing traffic between different IP networks is what it
does.

It's not a Linux or Unix thing; any box configured to be a router will
act that way, because that's what it means to be a router.

(If I understand correctly, nowadays you can also set up Linux to act
as multiple independent routers, with multiple IP stacks.  That might
be closer to your mental model of your setup.  However, all you really
seem to need is a firewall.)

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#4161

On 06/22/2018 04:45 PM, Jorgen Grahn wrote:
> Look at it a different way, and it may be easier to see.  It's a /router/: 
> routing traffic between different IP networks is what it does.

Yep.

> It's not a Linux or Unix thing; any box configured to be a router will 
> act that way, because that's what it means to be a router.

Yep.

> (If I understand correctly, nowadays you can also set up Linux to act 
> as multiple independent routers, with multiple IP stacks.  That might 
> be closer to your mental model of your setup.

Yep.

I can quickly think of the following ways to make Linux pretend to be 
multiple discrete routers.

  - ip rules + associated routing tables
  - Network Namespaces
  - L3MDEV
  - User Mode Linux
  - Virtual Machine
  - GNS3 (Dynamips) hosting virtual routers

I feel like there might be others too, but I can't think of them at the 
moment.

Most of these options would create two little routers that have their 
respective LAN and an Internet connection.  Then these mini-routers 
Internet connections would likely be on the same LAN and have a common 
upstream Internet connection.

There are a LOT of things that can be done.

> However, all you really seem to need is a firewall.)

I agree that a firewall is probably one of the simplest methods and 
likely fits within distribution initialization scripts.  Other methods 
will likely need additional start up scripts to (re)configure them at boot.

I might consider ip rules + associated routing tables as it might be 
faster than a firewall at processing packets.  But I don't think that 
the OP cares about optimal performance verses just making it work. 
Besides, the performance difference at this level is going to be 
effectively non-existent.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

#4145

On 06/21/2018 01:36 PM, Jorgen Grahn wrote:
> Why not do it the straightforward way -- just a router with three networks 
> attached, and NATing against the internet on a fourth interface?
> 
>      +-----+
> world|     +---- 196.168.1/24 ethernet
> -----+     +---- 196.168.2/24 wifi
>      |     +---- 196.168.3/24 guest wifi
>      +-----+
> 
> That would make it easier to reason about.

It looks like Kevin has two sets of networks, both of which are wired 
and wireless.  I'm guessing that he wants {home,guest} wired and 
wireless to be connected so that wired and wireless devices can 
communicate with each other.

home wired can talk to home wireless

guest wired can talk to guest wireless

home {wired,wireless} can't talk to guest {wired,wireless}.



-- 
Grant. . . .
unix || die

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.os.linux.networking

csiph-web