[LARTC] bridge or vlan

[Grant Taylor]

On 10/20/07 06:23, Vaidas M wrote:
> Hello to everyone,
> 
> Here is the situation:
> 
> [LAN1]---[eth3]/----------\
>                | LinuxBR  |[eth2]---[LAN0]---[linuxGW]---[internet]
> [LAN2]---[eth4]\----------/
> 
> Whole LAN is in subnet 10.0.0.0/24.
> 
> So I need:
> 
> LAN0, LAN1, LAN2 could not see each other.
> LAN0, LAN1, LAN2 is in same subnet (10.0.0.0/24).
> 
> All LANs have to get only internet.
> 
> How can I configure LinuxBR to do so?
> 
> Do I have to do only bridge? Or only vlan? Or both?

This is very simple to do.  Bridge all your LANs together (what ever 
interface you choose to use, physical and / or VLAN) and use EBTables to 
block forwarding of any traffic that has a source and destination on 
your 10.0.0.0/24 network.  This will allow traffic from the LAN to the 
world and from the world to the LAN to be bridged, but not allow LAN to 
LAN traffic to be bridged.

ebtables -t filter -A FORWARD --ip-src 10/24 --ip-dst 10/24 -j DROP

This will block all IP traffic.  Broadcasts and ARPs will get through, 
but can be stopped if you do want.  If you do want broadcasts and ARPs 
to be stopped let me know and I'll propose some follow up rules to add 
to the above to stop them.



Grant. . . .