download

Network Configuration—Routing and BridgingMore detail about firewalling functionality in FreeBSD 7 is covered inChapter 12. Here, basically we learn how to configure an ipfw-basedfirewall as a bridge.To configure a filtering bridge, you need to enable the native firewall functionality ofFreeBSD (that is ipfw) in kernel. However, your bridge should pass all ARP trafficbetween interfaces. You should instruct your firewall to pass ARP traffic using one ofthese scenarios:• To pass all traffic by default by adding options IPFIREWALL_DEFAULT_TO_ACCPET in the kernel configuration file and then block all inappropriate traffic.• Block all traffic by default, except the ARP traffic, using a simple rule likethis—ipfw add pass mac-type arp layer2.Using this trick, your firewall seems almost transparent. Now you can defineappropriate rules to filter out or pass traffic based on your security policies.Proxy ARPWhen a host wants to transmit a packet to another host on the same subnet, it willlook up for the Ethernet address of the destination host in the local MAC addressmapping (ARP) table. If a mapping entry does not exist, the host broadcasts an ARPdiscovery request. All the hosts on the same subnet pick up the request from thewire, and the host in question will answer the request.In normal circumstances, only the host that has the requested address on its interfacewill answer with an ARP reply packet. But there may be cases where hosts on thesame subnet are not on the same physical network, and typically, a layer3 host(for example router) is in between. A good example for this could be the dial-inor VPN gateways.In this situation, the hosts behind the router do not see the ARP requests, and therequests fail. The router should answer the ARP requests on behalf of these hosts.This is called Proxy ARP.Proxy ARP should not be confused with bridging, as the host in betweenis actually a router (layer3 host) instead of a bridge (layer2 host).This can be achieved by manually adding static ARP entries, for each individualhost, to the ARP proxying router:# arp -s 10.0.21.14 00:11:de:ad:be:ef pub[ 172 ]