[LARTC] Transparent bridging / smart rate limiting

[Tor Inge Kloumann]

I’ve decided to try to make a transparent bridge, that should drop packet’s based on some weird rules. I have googled around a bit and couldn’t find any information about what I would like to do. And therefore I now send a mail to this mailinglist in hope that someone can either help me, or point me in the right direction.   What I want to do is the following: Make a transparent bridge that starts dropping ICMP packets that are oversized(malicious icmp), drop all syn packets that comes from spoofed hosts(non existent ip’s), drop other obvious malicious traffic. My problem is not dropping packets(hehe), the problem is dropping packets based on these rules, so that legit icmp/syn traffic etc will not be affected by the rules. I’ve done some testing with hogwash as transparent bridge to intercept and block malicious packets. I was however not able to use hogwash to drop icmp/syn based on above clearified rules.     If someone could point me in the right direction/maybe someone has some examples(?) I would be very greatfull. Thanks in advance for any help.   Your’s, Tor Inge Kloumann Stfu-certified engineer