[Firehol-support] message from xt_physdev when running firehol in bridge configuration

Phineas Gage phineas919 at gmail.com
Thu Dec 4 08:51:50 GMT 2014


Ok thanks, if I find some other way I’ll let you know, meanwhile it could be something for the docs…

Phineas

> On Dec 4, 2014, at 1:11 AM, Tsaousis, Costa <costa at tsaousis.gr> wrote:
> 
> Well,
> 
> I guess the error message says it all: using --physdev-out in the
> OUTPUT, FORWARD and POSTROUTING chains for non-bridged traffic is not
> supported anymore.
> 
> This is reported by the kernel. I cannot do much about it, other than accept it.
> 
> This means you can only use physin/physout on traffic bridged (i.e.
> passing from one ethernet port to another - not on traffic comming in
> from a bridged interface toward the linux box, or from the linux box
> to another host via a bridged interface).
> 
> If you can find an alternative way using plain iptables commands, I
> could try to add support for them in firehol.
> 
> Regards,
> 
> Costa
> 
> 
> On Wed, Dec 3, 2014 at 6:14 PM, Phineas Gage <phineas919 at gmail.com> wrote:
>> Hi Costa,
>> 
>> Just getting to testing this more (with firehol-master-6c005c3), and I’m
>> trying to create servers that only accept on a certain physical interface,
>> but haven’t gotten that working yet. For example, here's a simplified
>> version of an interface to try to accept the openvpn service on the external
>> interface, and a few services on the internal interface (following the
>> example on
>> http://firehol.org/firehol-manual/firehol-params/#firehol-params5):
>> 
>> interface46 br0 bridge
>>    server openvpn accept physin eth1
>>    server "dns ssh icmp" accept physin eth0
>>    client all accept
>>    server all reject
>> 
>> But I get error messages like this (similar ones follow for other services):
>> 
>> ERROR   : # 1.
>> WHAT    : A runtime command failed to execute (returned error 1).
>> SOURCE  : line 56 of /etc/firehol/firehol.conf
>> COMMAND : /sbin/iptables -t filter -A out_bridge_openvpn_s4 -m physdev
>> --physdev-is-out --physdev-out eth1 -p tcp --sport 1194 --dport 1024:65535
>> -m conntrack --ctstate ESTABLISHED -j ACCEPT
>> OUTPUT  :
>> 
>> iptables: Invalid argument. Run `dmesg' for more information.
>> 
>> And the dmesg output:
>> 
>> xt_physdev: using --physdev-out in the OUTPUT, FORWARD and POSTROUTING
>> chains for non-bridged traffic is not supported anymore.
>> 
>> I suppose this should work for servers, and clients as well?
>> 
>> thanks,
>> Phineas
>> 
>> On Nov 19, 2014, at 11:47 AM, Phineas Gage <phineas919 at gmail.com> wrote:
>> 
>> Thanks Costa, that does stop the warning messages for me. Now I’m verifying
>> everything works as expected, but I’m still trying to figure out the right
>> way to specify rules for bridges. My setup is:
>> 
>> eth0 <> br0 <> eth1
>> 
>> My questions are:
>> 
>> 1) In this case, I should not need interface definitions for eth0 and eth1
>> right? Neither has an IP address, since they’re bridged, and adding
>> interface definitions for them doesn't seem to do anything.
>> 
>> 2) For interface definitions for bridges, when I have:
>> 
>> interface46 br0 bridge
>>  # Rules for clients and servers in and out of br0 go here, and are
>> working, but how do I add rules that should ONLY work on eth1 or eth0?
>>  # Do I specify two interfaces, for example: "interface46 br0 bridgeout
>> physin eth0 physout eth1” and "interface46 br0 bridgein physin eth1 physout
>> eth0”?
>>  # And in that case do I still need “interface46 br0 bridge”? I locked
>> myself out of my firewall a couple of times so it might be easier to ask
>> what’s right.
>> 
>> Phineas
>> 
>> On Nov 19, 2014, at 1:01 AM, Tsaousis, Costa <costa at tsaousis.gr> wrote:
>> 
>> Hi all,
>> 
>> I just pushed a version of firehol that adds these:
>> 
>> --physdev-is-bridged in routers
>> --physdev-is-in at the input of interfaces
>> --physdev-is-out at the output of interfaces
>> 
>> I verified it generates the proper statements for both interfaces and
>> routers.
>> I can't check if it works though. Please check it and let us know.
>> 
>> There is one issue with helpers (NAT, marks, etc). In that case, it
>> will assume --physdev-is-bridged only if both physin and physout are
>> given to the firehol statement. Otherwise, it will use --physdev-is-in
>> for physin and --physdev-is-out for physout. I am not sure if this has
>> any implications. This might be an issue in rare cases (example:
>> marking packets routed, using just physin), but I can't think of an
>> easy fix now. So, if you need physin/physout in helpers (statements
>> before interfaces and routers), please report a few use cases to help
>> us figure out how to solve it.
>> 
>> Thanks.
>> 
>> Costa
>> 
>> 
>> On Wed, Nov 19, 2014 at 1:24 AM, Tsaousis, Costa <costa at tsaousis.gr> wrote:
>> 
>> Hi JT.
>> 
>> Thanks for the tip.
>> New options available:
>> 
>> physdev match options:
>> [!] --physdev-in inputname[+]          bridge port name ([+] for wildcard)
>> [!] --physdev-out outputname[+]        bridge port name ([+] for wildcard)
>> [!] --physdev-is-in                    arrived on a bridge device
>> [!] --physdev-is-out                   will leave on a bridge device
>> [!] --physdev-is-bridged               it's a bridged packet
>> 
>> In your example you have used --physdev-is-bridged
>> As I understand it, we have to use:
>> 
>> --physdev-is-bridged in routers
>> --physdev-is-in at the input of interfaces
>> --physdev-is-out at the output of interfaces
>> 
>> Since I cannot test it, I need your help to figure this out.
>> Do you agree?
>> 
>> Costa
>> 
>> 
>> 
>> On Tue, Nov 18, 2014 at 9:26 PM, JT <admin at jtlabs.net> wrote:
>> 
>> I'm having the same problem using bridged traffic. My resolution has
>> been to write my own manual iptables entries in firehol.conf.
>> 
>> vif+  <> br0 <> br1<> eth1
>>        /\
>>        \/
>>       eth0
>> 
>> br0 and br1 have physical address associated with them (eth0/vif+ and
>> eth1 respectively). Whenever I try to route or create interface rules
>> with a physout/physin I get the syslog message (even though it is
>> bridged traffic). Please let me know if it's user error.
>> 
>> For example, firehol.conf has:
>> router vm2inet inface vif+ outface br0 physout eth0
>>  route all               accept
>> 
>> which generates:
>> "xt_physdev: using --physdev-out in the OUTPUT, FORWARD and POSTROUTING
>> chains for non-bridged traffic is not supported anymore."
>> 
>> instead I use:
>> iptables -I FORWARD -m physdev --physdev-is-bridged --physdev-in vif+
>> --physdev-out eth0 -j ACCEPT
>> 
>> So far any combination of inface/outface/physin/physout generates the
>> message. Let me know what other information I can provide.
>> 
>> Thanks,
>> 
>> JT
>> 
>> On 11/18/2014 9:12 AM, Tsaousis, Costa wrote:
>> 
>> Hi Phineas,
>> 
>> Can you trace it down?  Are you using physin/out on non-bridged traffic
>> only?
>> Try to run a few commands by hand to check which ones complain.
>> 
>> Regards,
>> 
>> Costa
>> 
>> 
>> 
>> On Tue, Nov 18, 2014 at 3:59 PM, Phineas Gage <phineas919 at gmail.com> wrote:
>> 
>> Hi,
>> 
>> I’m getting this message many times in my syslog when running firehol:
>> 
>> xt_physdev: using --physdev-out in the OUTPUT, FORWARD and POSTROUTING
>> chains for non-bridged traffic is not supported anymore.
>> 
>> This happens only when I use either the ‘physin’ or ‘physout’ keywords on
>> either my router definitions or route subcommands for the br0 (bridge)
>> interface. If I omit those keywords it doesn’t happen. Can I still use
>> ‘physin’ and ‘physout’ with my bridge somehow? They’re useful for knowing
>> which direction the traffic is going through the bridge...
>> 
>> Phineas
>> 
>> _______________________________________________
>> Firehol-support mailing list
>> Firehol-support at lists.firehol.org
>> http://lists.firehol.org/mailman/listinfo/firehol-support
>> 
>> _______________________________________________
>> Firehol-support mailing list
>> Firehol-support at lists.firehol.org
>> http://lists.firehol.org/mailman/listinfo/firehol-support
>> 
>> 
>> _______________________________________________
>> Firehol-support mailing list
>> Firehol-support at lists.firehol.org
>> http://lists.firehol.org/mailman/listinfo/firehol-support
>> 
>> _______________________________________________
>> Firehol-support mailing list
>> Firehol-support at lists.firehol.org
>> http://lists.firehol.org/mailman/listinfo/firehol-support
>> 
>> 
>> _______________________________________________
>> Firehol-support mailing list
>> Firehol-support at lists.firehol.org
>> http://lists.firehol.org/mailman/listinfo/firehol-support
>> 
>> 




More information about the Firehol-support mailing list