Precedence: list
MIME-Version: 1.0
From: "Williams, Gareth" <gareth@garethwilliams.me.uk>
Date: Thu, 10 May 2018 14:48:22 +0100
Message-ID: <CAOFedGwX=KjbfGozdwdgDXrhE6AkiaxFDSErSgf1sztY0iR__A@mail.gmail.com>
Subject: [alpine-user] Awall Duplicate Interface Name Dropped
To: alpine-user@lists.alpinelinux.org
Content-Type: multipart/alternative; boundary="000000000000de20bd056bda4598"

--000000000000de20bd056bda4598
Content-Type: text/plain; charset="UTF-8"

Hi,

If I create am Awall zone "Usr" with eth1+ as the interface definition,
awall drops any filters that contain "Usr" as both In and Out.  The simply
don't show up in iptables -Lv.

If eth1 resolves to just eth1 then this makes sense as any eth1 traffic
wouldn't need to traverse a router to get to any other eth1 device.
However, if I have VLANs as eth1.2, eth1.3 etc. I'd expect traffic between
them to be routed and to traverse the firewall.

A manually generated rule such as:

iptables -A FORWARD -p tcp -i eth1+ -o eth1+ --dport 123 -j ACCEPT

shows up in iptables -Lv therefore this isn't an iptables issue.

As a workaround, I could list all the VLAN interfaces in the zone
definition:

"Usr": {"iface": ["eth1.2", "eth1.3", "eth1.4", "eth1.5"]},

but this will create an exponentially increasing number of iptables rules.

Is this a bug in awall, or have I missed something?

Thanks in advance,

Gareth

--000000000000de20bd056bda4598
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<div><br></div><div>If I create am Awall zone &quot;Usr=
&quot; with eth1+ as the interface definition, awall drops any filters that=
 contain &quot;Usr&quot; as both In and Out.=C2=A0 The simply don&#39;t sho=
w up in iptables -Lv.</div><div><br>If eth1 resolves to just eth1 then this=
 makes sense as any eth1 traffic wouldn&#39;t need to traverse a router to =
get to any other eth1 device.=C2=A0 However, if I have VLANs as eth1.2, eth=
1.3 etc. I&#39;d expect traffic between them to be routed and to traverse t=
he firewall.</div><div><br></div><div>A manually generated rule such as:</d=
iv><div><br></div><div>iptables -A FORWARD -p tcp -i eth1+ -o eth1+ --dport=
 123 -j ACCEPT</div><div><br></div><div>shows up in iptables -Lv therefore =
this isn&#39;t an iptables issue.</div><div><br></div><div>As a workaround,=
 I could list all the VLAN interfaces in the zone definition:</div><div><br=
></div><div>&quot;Usr&quot;: {&quot;iface&quot;: [&quot;eth1.2&quot;, &quot=
;eth1.3&quot;, &quot;eth1.4&quot;, &quot;eth1.5&quot;]},=C2=A0</div><div><b=
r></div><div>but this will create an exponentially increasing number of ipt=
ables rules.</div><div><br></div><div>Is this a bug in awall, or have I mis=
sed something?</div><div><br></div><div>Thanks in advance,</div><div><br></=
div><div>Gareth</div></div>

--000000000000de20bd056bda4598--


---
Unsubscribe:  alpine-user+unsubscribe@lists.alpinelinux.org
Help:         alpine-user+help@lists.alpinelinux.org
---