Filtering PPPoE

[Grant Coady]

On Tue, 08 Aug 2006 10:32:45 -0500, Aleksandar Milivojevic <alex at milivojevic.org> wrote:

>Hi,
>
>I'm attempting to place transparent firewall (on a Linux host  
>configured as bridge) between ADSL modem and some servers.  The  
>servers and ADSL modem "speak" PPPoE.
>
>Simplified diagram looks like this:
>
>   +------+     +--------+     +---------+
>   |ADSL  |     |bridge/ |     |server(s)|
>   |modem |-----|firewall|-----|         |
>   +------+     +--------+     +---------+
>
>The problem I have is that Netfilter does not see PPPoE packets on the  
>bridge.

Did you switch ADSL modem to bridge mode?

 network topology
 `````````````````
     ----------------            ------------                   LAN
   (                  )  Phone  |            |                Machines
  (  Big Bad Internet  )--------| ADSL Modem |
   (                  )   Line  |            |    100-Base-T
     ----------------            ------------       Switch     -----
                                       |               -------|     |
                             Public IP | X_WORLD      |        -----
                                       |              |        -----
                                 -------------        |     --|     |
                                |  ppp0/eth2  |      ---   |   -----
                                |             |     | \ |--    -----
           X_LOCAL2       <-----|eth1     eth0|-----|/ /|-----|     |
           192.168.2.0/24       |             |     | \ |--    -----
           100-Base-T           |  Firewall   |      ---   |   -----
           (spare localnet)      -------------        |     --|     |
                                                      |        -----
                                                      |        -----
                                                       -------|     |
                                               X_LOCAL         -----
                                               192.168.1.0/24

Though I don't port-forward to DMZ servers -- that's the spare localnet 
that I've not got around to using.

Grant.