Home / server / Questions / 485381
In Process
Cat Mucius
Asked: 2013-03-07 13:24:55 +0800 CST

Changing Linux Layer2 forwarding decision?

  • 772

Are there tools to define in Linux something similar to Policy-based Routing, but on Layer2 level? Usual Linux bridge uses destination MAC to decide, which interface to send frame to. Can this behavior be altered?

Let's say we have a machine with several interfaces - physical, virtual, VLAN-tagged subinterfaces, etc. A frame arrives at one of them. Can we decide, which outgoing interface the frame will be delivered to, according to parameters such as VLAN tag in the frame, source MAC address, source interface, 802.1p priority, etc.?

kvm-virtualization

1 Answers

  1. Sounds like you are looking for ebtables

    The ebtables program is a filtering tool for a Linux-based bridging firewall. It enables transparent filtering of network traffic passing through a Linux bridge. The filtering possibilities are limited to link layer filtering and some basic filtering on higher network layers. Advanced logging, MAC DNAT/SNAT and brouter facilities are also included.

    The ebtables tool can be combined with the other Linux filtering tools (iptables, ip6tables and arptables) to make a bridging firewall that is also capable of filtering these higher network layers. This is enabled through the bridge-netfilter architecture which is a part of the standard Linux kernel.

    http://ebtables.sourceforge.net/

    • 1