Home / server / Questions / 244461
Accepted
Tzury Bar Yochay
Asked: 2011-03-08 19:42:21 +0800 CST

writing an iptables rule which forward OSPF packets from one interface to another

  • 772

In a given machine I have got two interfaces eth0 and eth1. Cisco routers are connected, to both interfaces, eth0 and eth1 and I want OSPF packets which arrives on eth0 to be forwarded to eth1 and vice versa (see image below).

I have tried issued the following commands:

iptables -A FORWARD -i eth1 -o eth0
iptables -A FORWARD -i eth0 -o eth1

But that did not work. Moreover, I wish this forwarding rule to apply on OSPF packets only, filtering packets by source and destination address and perhaps, even by protocol if possible. OSPF packets are appeared to be

IP 100.1.3.2 > 224.0.0.5: OSPFv2

from one direction, and 

IP 100.1.3.1 > 224.0.0.5: OSPFv2

from the other.

{cisco}--(linux)--{cisco}

router linux iptables ospf

1 Answers

  1. Best Answer

    [In your question it is not clear to me if the linux box is acting as a bridge/layer 2 or as a layer 3 device, so I'm assuming the later.]

    The OSPF Hello packets configured for a broadcast multiple-access network (i.e. ethernet) additionally to being sent to the multicast IP address of 224.0.0.5 are also sent to the multicast layer 2 ethernet MAC address of 01:00:5e:00:00:05. So unless your linux box is configured to bridge eth1 and eth0, the OSPF Hello packets will not make it across your firewall and the OSPF neighbor adjacencies will not be formed.

    Then you have this other issue that the TTL for an OSPF Hello packet is 1 so it cannot cross layer 3 boundaries without getting expired in transit.

    If you really, really want to do this, then you have to explore some other alternatives such as creating a GRE tunnel (an IPSec tunnel will also do the trick) between Router A and B and configure OSPF for a point-to-point link over this tunnel and then of course, allow through the firewall the traffic for the protocol you are using for the tunnel (i.e. 47 for GRE).

    For a good reference on how to configure OSPF over a GRE tunnel take a look at: Configuring a GRE Tunnel over IPsec with OSPF (disregard the IPSec part if you will)

    • 2