On Wed, Apr 27, 2005 at 10:15:25AM -0700, Gregory K. Ruiz-Ade wrote: >On Wednesday 27 April 2005 09:39 am, George Georgalis wrote: >> Anybody use knockd through a bridge.... On a bridge? >> I don't think it will work... > >Of course it would, if you use a firewalling bridge. I'm not sure it's >supported by default in Linux kernels, but you can use Linux to bridge and >still inspect every packet with iptables. Think of it as just like a >firewall, but the "protected" side is the same network segment as the >"hostile" side.
I'm dealing with a fairly complex network and I can't disclose it all anyway, so bear with me. testing knockd on a box worked fine. when I put it in production, I couldn't knock through the fairly strict bridge. the bridge does ALLOW the ports in the combination to pass through, but I cannot knock across it, and I get no drop/reject entries in the log (target or bridge) either. With no drop/reject messages, I'm thinking knock is not transmitting enough of a tcp connection for the bridge think it needs to forward it. ie a telnet attempt (or some other client that sends more than knock) to each of the combination ports would hit the trigger. So I was thinking to fudge it an make the target available and run knockd on the bridge, to add/remove a FORWARD rule there for access to the target. Then I recalled, when I tried knockd on lo, I got an error no MAC address. So I assume it cannot listen on br0 either. // George -- George Georgalis, systems architect, administrator Linux BSD IXOYE http://galis.org/george/ cell:646-331-2027 mailto:[EMAIL PROTECTED] -- [email protected] http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list
