Ttyjfyk

Latex does not go to next line

Are there historical instances of the capital of a colonising country being temporarily or permanently shifted to one of its colonies?

Linux Ubuntu 18.04 Full Backup

Do f-stop and exposure time perfectly cancel?

Is there a difference between equilibrium and steady state?

Child Theme Path Being Ignored With wp_enqueue_scripts

How to draw cubes in a 3 dimensional plane

Why the color red for the Republican Party

How is the wildcard * interpreted as a command?

Why was Goose renamed from Chewie for the Captain Marvel film?

Why is computing ridge regression with a Cholesky decomposition much quicker than using SVD?

How did Alan Turing break the enigma code using the hint given by the lady in the bar?

Conservation of Mass and Energy

Is "conspicuously missing" or "conspicuously" the subject of this sentence?

Coax or bifilar choke

Database Backup for data and log files

Death from old age has stopped, but fertility window is the same. What is the new population equlibrium?

If I receive a SOS signal, what is the proper response?

How can I get players to stop ignoring or overlooking the plot hooks I'm giving them?

Find longest word in a string: are any of these algorithms good?

Sort with one element at the end

How many characters using PHB rules does it take to be able to have access to any PHB spell at the start of an adventuring day?

Why does liquid water form when we exhale on a mirror?

How are showroom/display vehicles prepared?

Linux bridge SNAT with ebtables

4

I was reading the following code (dot1x bridge bypass):
https://github.com/mubix/8021xbridge/blob/master/scripts/trans_bridge.prepop

A quick description, we have 2 interfaces, the first is connected to a switch ($SWINT) and the other to our target host. The goal is to
interact with the rest of the network, while making it look like the traffic is generated by the target host.

From the referenced code, what I am trying to figure out is why both of the below commands are needed:

# use ebtables to source NAT the $COMPMAC for traffic leaving the device from the bridge mac address
(A)ebtables -t nat -A POSTROUTING -s $SWMAC -o $SWINT -j snat --to-src $COMPMAC
(B)ebtables -t nat -A POSTROUTING -s $SWMAC -o $BRINT -j snat --to-src $COMPMAC

I don't get why it's needed to SNAT the POSTROUTING traffic of $BRINT. Since our goal is to avoid transmitting any frames towards switch side interface with source MAC different than the target host, shouldn't the first ebtables rule be suffice?

Or in other words, isn't $SWINT (switch side interface) the only way any frames are getting to the switch? Based on the diagram below, the rule (B) looks redundant since we only care for frames going towards eth0 (SWINT), and we already apply SNAT to eth0.

Some good resources I found on bridges (but still haven't answered my question) are:

Understanding Linux Network Internals

Anatomy of Linux Bridge

ebtables with Linux Bridge

https://doc.lagout.org/operating%20system%20/linux/Understanding%20Linux%20Network%20Internals.pdf Page 359

firewall bridge

share|improve this question

edited 2 hours ago

gip

asked Jan 13 at 20:21

gipgip

665

add a comment | 

4

I was reading the following code (dot1x bridge bypass):
https://github.com/mubix/8021xbridge/blob/master/scripts/trans_bridge.prepop

A quick description, we have 2 interfaces, the first is connected to a switch ($SWINT) and the other to our target host. The goal is to
interact with the rest of the network, while making it look like the traffic is generated by the target host.

From the referenced code, what I am trying to figure out is why both of the below commands are needed:

# use ebtables to source NAT the $COMPMAC for traffic leaving the device from the bridge mac address
(A)ebtables -t nat -A POSTROUTING -s $SWMAC -o $SWINT -j snat --to-src $COMPMAC
(B)ebtables -t nat -A POSTROUTING -s $SWMAC -o $BRINT -j snat --to-src $COMPMAC

I don't get why it's needed to SNAT the POSTROUTING traffic of $BRINT. Since our goal is to avoid transmitting any frames towards switch side interface with source MAC different than the target host, shouldn't the first ebtables rule be suffice?

Or in other words, isn't $SWINT (switch side interface) the only way any frames are getting to the switch? Based on the diagram below, the rule (B) looks redundant since we only care for frames going towards eth0 (SWINT), and we already apply SNAT to eth0.

Some good resources I found on bridges (but still haven't answered my question) are:

Understanding Linux Network Internals

Anatomy of Linux Bridge

ebtables with Linux Bridge

https://doc.lagout.org/operating%20system%20/linux/Understanding%20Linux%20Network%20Internals.pdf Page 359

firewall bridge

share|improve this question

edited 2 hours ago

gip

asked Jan 13 at 20:21

gipgip

665

add a comment | 

I was reading the following code (dot1x bridge bypass):
https://github.com/mubix/8021xbridge/blob/master/scripts/trans_bridge.prepop

A quick description, we have 2 interfaces, the first is connected to a switch ($SWINT) and the other to our target host. The goal is to
interact with the rest of the network, while making it look like the traffic is generated by the target host.

From the referenced code, what I am trying to figure out is why both of the below commands are needed:

# use ebtables to source NAT the $COMPMAC for traffic leaving the device from the bridge mac address
(A)ebtables -t nat -A POSTROUTING -s $SWMAC -o $SWINT -j snat --to-src $COMPMAC
(B)ebtables -t nat -A POSTROUTING -s $SWMAC -o $BRINT -j snat --to-src $COMPMAC

I don't get why it's needed to SNAT the POSTROUTING traffic of $BRINT. Since our goal is to avoid transmitting any frames towards switch side interface with source MAC different than the target host, shouldn't the first ebtables rule be suffice?

Or in other words, isn't $SWINT (switch side interface) the only way any frames are getting to the switch? Based on the diagram below, the rule (B) looks redundant since we only care for frames going towards eth0 (SWINT), and we already apply SNAT to eth0.

Some good resources I found on bridges (but still haven't answered my question) are:

Understanding Linux Network Internals

Anatomy of Linux Bridge

ebtables with Linux Bridge

https://doc.lagout.org/operating%20system%20/linux/Understanding%20Linux%20Network%20Internals.pdf Page 359

firewall bridge

share|improve this question

edited 2 hours ago

gip

asked Jan 13 at 20:21

gipgip

665

# use ebtables to source NAT the $COMPMAC for traffic leaving the device from the bridge mac address
(A)ebtables -t nat -A POSTROUTING -s $SWMAC -o $SWINT -j snat --to-src $COMPMAC
(B)ebtables -t nat -A POSTROUTING -s $SWMAC -o $BRINT -j snat --to-src $COMPMAC

share|improve this question

edited 2 hours ago

gip

asked Jan 13 at 20:21

gipgip

665

share|improve this question

edited 2 hours ago

gip

asked Jan 13 at 20:21

gipgip

665

asked Jan 13 at 20:21

gipgip

665

asked Jan 13 at 20:21

gipgip

665