I have a linux AP with prism2 (hostap) wireless nic. I whant to filter traffic that pass betwen clients of the AP, this is layer 2 traffic (802.11) and netfilter does not sees it, at first i think in physdev target, but is for layer2 bridged interfaces, and this is not the case. There is a way to filter layer2 traffic independet if it is from a bridged iface or not? -- Luciano
ebtables Luciano Ruete wrote:>I have a linux AP with prism2 (hostap) wireless nic. > >I whant to filter traffic that pass betwen clients of the AP, this is layer 2 >traffic (802.11) and netfilter does not sees it, at first i think in physdev >target, but is for layer2 bridged interfaces, and this is not the case. > >There is a way to filter layer2 traffic independet if it is from a bridged >iface or not? > >
On Tuesday 09 January 2007 11:00, Zoilo Gomez wrote:> ebtablesfrom ebtables home page: "The ebtables utility enables basic Ethernet frame filtering on a Linux bridge" I have _not_ a bridge (that''s why i put it in the subject), i have a Linux AP that forward traffic betwen clients at 802.11 level. -- Luciano
Isn''t an AP just a bridge with a wireless interface? Luciano Ruete wrote:>On Tuesday 09 January 2007 11:00, Zoilo Gomez wrote: > > >>ebtables >> >> > >from ebtables home page: >"The ebtables utility enables basic Ethernet frame filtering on a Linux >bridge" > >I have _not_ a bridge (that''s why i put it in the subject), i have a Linux AP >that forward traffic betwen clients at 802.11 level. > > >
On 01/11/07 06:01, Zoilo Gomez wrote:> Isn''t an AP just a bridge with a wireless interface?In a sense, yes. However the 802.11 wireless side of the bridge is a very complex physical layer, (IMHO) more so than 802.3 ethernet. Host AP is probably listening to requests at the physical tranceiver level. If the Host AP is operating in an AP mode (wouldn''t it be?) it will have to be involved in passing the traffic from one 802.11 client to another. This is really a form of bridging on the physical layer, not layer 2 in the kernel. Thus EB / IP Tables will not help here. I have not (yet) personally worked with Host AP, though I plan to. As such, I''m not sure if it includes functionality to filter the traffic that it sees. I wonder if it would be a possibility to (theoretically) move / extend the functionality of Host AP such that each associated wireless client would (logically / theoretically) appear as a separate interface to a custom bridge that could then be presented / controlled via EBTables. However, this is quite likely exceeding the 802.11 specification in such a way that it would really no longer be 802.11. Something to keep in mind is that in Infrastructure wireless mode, one wireless client has to talk to the AP and have the AP talk to another wireless client on it''s behalf. I believe this is the ""bridging that the OP is referring to. Note, I use the term bridging loosely here. On a side note, how well do you like Host AP? Grant. . . .
Thank you for your clarification, Grant. In a different setup, I have been using Access Points (i.e. Trendnet TEW453APB) with the ''wireless isolation'' flag enabled in the configuration setup. In this configuration, wireless clients cannot see each other, and all traffic is forwarded to the Linux router. But I must admit that I never looked into this using Host AP. Still, I would expect that there should be a way to achieve this kind of configuration using Host AP....? Grant Taylor wrote:> On 01/11/07 06:01, Zoilo Gomez wrote: > >> Isn''t an AP just a bridge with a wireless interface? > > > In a sense, yes. However the 802.11 wireless side of the bridge is a > very complex physical layer, (IMHO) more so than 802.3 ethernet. > > Host AP is probably listening to requests at the physical tranceiver > level. If the Host AP is operating in an AP mode (wouldn''t it be?) it > will have to be involved in passing the traffic from one 802.11 client > to another. This is really a form of bridging on the physical layer, > not layer 2 in the kernel. Thus EB / IP Tables will not help here. > > I have not (yet) personally worked with Host AP, though I plan to. As > such, I''m not sure if it includes functionality to filter the traffic > that it sees. > > I wonder if it would be a possibility to (theoretically) move / extend > the functionality of Host AP such that each associated wireless client > would (logically / theoretically) appear as a separate interface to a > custom bridge that could then be presented / controlled via EBTables. > However, this is quite likely exceeding the 802.11 specification in > such a way that it would really no longer be 802.11. > > Something to keep in mind is that in Infrastructure wireless mode, one > wireless client has to talk to the AP and have the AP talk to another > wireless client on it''s behalf. I believe this is the ""bridging that > the OP is referring to. Note, I use the term bridging loosely here. > > On a side note, how well do you like Host AP? > > > > Grant. . . . > _______________________________________________ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > >