OpenWrt Forum Archive

Topic: Transparent Firewall

The content of this topic has been archived on 5 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Does anyone has working transparent firewall on WRT54GS between WAN port and LAN Ports (wifi is disable) ? 


A tried the specific HOWTO with RC3 recompiled and RC4. No success
I found nothing that could help me on this forum.

If any one as a working one, i'm interesting with :
- Openwrt version
- Optional package version
- nvram show
- specific init script
... and others things that i forget.


Thanks

Philippe

By "transparent firewall" do you mean that the WAN and LAN ports are bridged together? And what do you want this firewall to actually do?

I have bridge filtering working between LAN and Wifi:

# ipkg install ebtables
# insmod ebtables
# insmod ebtable_filter
# ebtables -L
Bridge table: filter

Bridge chain: INPUT, entries: 0, policy: ACCEPT

Bridge chain: FORWARD, entries: 0, policy: ACCEPT

Bridge chain: OUTPUT, entries: 0, policy: ACCEPT

There's no patching required; I'm actually running pre-RC5 dated 12th February, but I don't see why this shouldn't work with RC4. You need to put those insmod commands into your own startup script.

I suggest you start with basic stuff: for example, try logging all broadcast packets which hit the box.

# insmod ebt_log
Using /lib/modules/2.4.30/ebt_log.o
# ebtables -A INPUT --dst ff:ff:ff:ff:ff:ff --log --log-arp --log-ip
... now send some broadcasts, e.g. from another machine ping a non-existent LAN IP address ...
# logread

Then move onto whatever functionality you want your "transparent firewall" to do. If it's packet filtering, add rules to the FORWARD chain. If you need to do something fancy like masquerading to the same MAC address, read the documentation at http://ebtables.sourceforge.net/ and http://ebtables.sourceforge.net/examples.html

In any case, you will first need to bridge together than WAN and LAN ports using the Linux software bridge: remove all the wan_* settings and add

lan_ifname=br0
lan_ifnames=vlan0 vlan1

HTH, Brian.

The discussion might have continued from here.