Hy all! I've upgraded a site, wich uses a 6port bridge and a 2port bridge, bridging ethernet interfaces only. One bridge for servers, and one bridge for network access. I was using 2.9, but because a hw upgrade I was in a neddd to support 2 CPUs and gigabit ethernet cards that had no support in 2.9. after I did the upgrade to 3.0rc4 my firewall rules were did not match.
I want to filter the traffic between the bridge ports. In 2.9 it was working fine. In 3.0 I turned on the USe ip firewall at the bridge section, but only the rules in the INPUT table started to work. In the FORWARD table I can match only for bridge interfaces,
In the firewall section, I'm using Advanced -> Out/in bridge port to match the needed bridge port, but it is not working any more. Packets simply does not match. I tried to LOG the packets, but in the log I can see only the bridge interface, not the physical one. As soon as I set any match based on the physical bridge port, packets simply does not match. My question is: Are there any differences btw 2.9 and 3.0 on this feature? Or is it a sw bug? Or what the hell to do to make my old rules working...
/interface bridge> port print
Flags: X - disabled, I - inactive, D - dynamic
INTERFACE BRIDGE PRIORITY PATH-COST
0 eth4-NK_WWW NET 0x80 10
1 eth5-PORTAL NET 0x80 10
2 eth8-ELEARNING NET 0x80 10
3 eth1-in LAN 0x80 10
4 eth9-out NET 0x80 10
5 eth3-HIVATAL NET 0x80 10
6 eth2-ESERVICE NET 0x80 10
7 eth6-NK_MAIL NET 0x80 10
an example rule that is not working:
69 ;;; NK MAIL -> INTERNET
chain=forward action=accept connection-state=new src-address=******** in-interface=NET out-interface=NET dst-port=80 protocol=tcp in-bridge-port=eth6-NK_MAIL out-bridge-port=eth9-out
If I telnet to this port with the given IP, it is working. I can see tha packet:
log entry says: in:NET, out:NET, proto TCP, etc… I’ve added the interface matching:
/interface bridge port print
Flags: X - disabled, I - inactive, D - dynamic
INTERFACE BRIDGE PRIORITY PATH-COST
0 eth4-NK_WWW NET 0x80 10
1 eth5-PORTAL NET 0x80 10
2 eth8-ELEARNING NET 0x80 10
3 eth1-in LAN 0x80 10
4 eth9-out NET 0x80 10
5 eth6-NK_MAIL NET 0x80 10
6 eth3-HIVATAL NET 0x80 10
7 eth2-ESERVICE NET 0x80 10
Hm. I do not have “out-bridge” in the options. I have only out/in-bridge-port and out/in-interface.
Are you using the “/ip firewall filter” section?
Is there a possible incompatibility btw 2.9 and 3.0 of processing the rules? I’m using the standard ip->firewall and not the bridge->filters option to firewall on the bridge.
And what about:
chain=forward action=log dst-address=IP dst-port=2222
protocol=tcp out-interface=NET out-bridge-port=eth6-NK_MAIL log-prefix=“LOG-”
I’d also try Tools-Packet Sniffer with interface set to “all” - for me it shows the bridge input interface (e.g. ether1) then the bridge (bridge1) then the bridge output interface (ether2), so I can see how the packet flows through the router.
hmm… By using the Packet Sniffer, I can see packet coming to eth9-out and then NET bridge, but ccannot see the output interface. Other interresting thing, I’ve tried to filter the incming if or bridge port. With ncoming if and br the rule was working, but not with output…
by default it is “no”