IPTABLES and EBTABLES

[Lázaro Morales]

Hello,

How can be used EBTABLES in addition to IPTABLES to forward traffic
 from an internal LAN to an external?

Suppose that I have an internal LAN with private IPs, and a Gateway
that control the traffic to the outside, and I only need forward traffic
for certain MAC address regardless IP address.

INTERNET  --> Gateway <--- LAN

I'm not sure if I have to enable the following modules in `sysctl.conf`:
   net.bridge.bridge-nf-call-iptables = 0
   net.bridge.bridge-nf-call-arptables = 0

I have tried with the following configuration, but nothing happens:

# ebtables -F
# ebtables -t nat -F
# ebtables -P INPUT ACCEPT
# ebtables -P OUTPUT ACCEPT
# ebtables -P FORWARD ACCEPT
# ebtables -A FORWARD -i eth0 -o eth1 -j ACCEPT
# ebtables -t nat -A POSTROUTING -s INTERNAL_LAN_CLIENT_MAC -o eth1 \
            -j snat --to-source MAC_OF_EXTERNAL_GATEWAY_INTERFACE

Any thought will be highly appreciated.
Thanks in advance,
Lázaro.

*****************************************************************************
*  Este mensaje de correo electrónico ha sido procesado  por el  *
*  Servidor  de Correo  Electrónico  de  Frioclima  y  es un correo *
*  válido para el dominio: frioclima.com.cu                                     *
*****************************************************************************

[Bill Davidsen]

Lázaro Morales wrote:
> Hello,
>
> How can be used EBTABLES in addition to IPTABLES to forward traffic
> from an internal LAN to an external?
>
> Suppose that I have an internal LAN with private IPs, and a Gateway
> that control the traffic to the outside, and I only need forward traffic
> for certain MAC address regardless IP address.
>    INTERNET  --> Gateway <--- LAN
>
> I'm not sure if I have to enable the following modules in `sysctl.conf`:
>    net.bridge.bridge-nf-call-iptables = 0
>    net.bridge.bridge-nf-call-arptables = 0
>
> I have tried with the following configuration, but nothing happens:
>
> # ebtables -F
> # ebtables -t nat -F
> # ebtables -P INPUT ACCEPT
> # ebtables -P OUTPUT ACCEPT
> # ebtables -P FORWARD ACCEPT
> # ebtables -A FORWARD -i eth0 -o eth1 -j ACCEPT
> # ebtables -t nat -A POSTROUTING -s INTERNAL_LAN_CLIENT_MAC -o eth1 \
>             -j snat --to-source MAC_OF_EXTERNAL_GATEWAY_INTERFACE
>
> Any thought will be highly appreciated.

I'm watching the answers carefully, since I have a somewhat similar problem. If 
I find anything in my work which looks useful, I'll share.