Re: bridge changes traffic interface for pf, but not for tcpdump

2005-07-06 Thread Jim Fron
On Jul 6, 2005, at 9:03 AM, Todd C. Miller wrote: In message <[EMAIL PROTECTED]> so spake Jim Fron (j-fron.q.public): Yes, I'm getting the feeling that what I'm seeing is "not normal." As I've said, I have a suspicion that it's due to the le[dma] SBUS interfaces not having their own MA

Re: bridge changes traffic interface for pf, but not for tcpdump

2005-07-06 Thread j-fron . q . public
I've been informed, if I understand correctly, that bridge isn't intended to do what I want to do with it. FWIW, anyone who is interested, I'm hanging up the modification effort at "half complete," because it accomplishes everything I need. That is, I'm interested in blocking traffic to the ro

Re: bridge changes traffic interface for pf, but not for tcpdump

2005-07-06 Thread Todd C. Miller
In message <[EMAIL PROTECTED]> so spake Jim Fron (j-fron.q.public): > Yes, I'm getting the feeling that what I'm seeing is "not normal." As > I've said, I have a suspicion that it's due to the le[dma] SBUS > interfaces not having their own MAC address, and that somehow getting > confus

Re: bridge changes traffic interface for pf, but not for tcpdump

2005-07-06 Thread Jim Fron
On Feb 25, 2005, at 3:43 AM, Pierre-Yves Ritschard wrote: Jim Fron wrote: Since I'm running an SS20, all of my _real_ interfaces have the same MAC address (for Sparc 32-bit, it's a property of the machine, not the NIC). My SS20 is not at hand for the moment, but i do think there is an open

Re: bridge changes traffic interface for pf, but not for tcpdump

2005-07-06 Thread Jim Fron
Good news! I'm half-way there. I took Camiel's patch to bridge_input() in if_bridge.c ref: google:"bridging vlans on a single interface" and modified it slightly so that the source interface would not get rewritten if the destination mac address matches, period. (no longer vlan-specific) T

bridge changes traffic interface for pf, but not for tcpdump

2005-07-06 Thread Jim Fron
Okay, here's the deal: when I bridge two interfaces, one of which has an IP address, traffic from nodes on one side to the other passes through pf just fine, all rules matching properly. Traffic TO the OpenBSD system itself hits pf rules for "in" on "le2," and "out" on "le0" regardless of whic

Re: bridge changes traffic interface for pf, but not for tcpdump

2005-07-06 Thread Jim Fron
This is an intriguing problem that certaiinly is going against everything I know about how pf and bridging is supposed to work on OpenBSD. Anyhow, I have come up with some things that might help you ascertain what is going on with the firewall. I reread your initial emails and follow ups to e

Re: bridge changes traffic interface for pf, but not for tcpdump

2005-07-06 Thread Jim Fron
On Feb 27, 2005, at 2:00 PM, Camiel Dobbelaar wrote: On Sun, 27 Feb 2005, Jim Fron wrote: Yes, I'm getting the feeling that what I'm seeing is "not normal." As I've said, I have a suspicion that it's due to the le[dma] SBUS interfaces not having their own MAC address, and that somehow getti

Re: bridge changes traffic interface for pf, but not for tcpdump

2005-07-06 Thread Jim Fron
I found this: http://openbsd.automagic.org/plus.html "Apply bridge filter rules to frames destined for the local machine, so a single-interface bridge can do filtering and tagging." And then searched on that phrase, and found this: http://www.monkey.org/openbsd/arch