My redundant bridging firewall don't work no more with 3.6!

Hi folks, a while back I set up a redundant bridging firewall and I wrote up
a web page describing how it works.  Well, now that I've upgraded to 3.6,
I've discovered it doesn't work any more.  So!  If you were going to follow
the directions in my web page to build a redundant bridging firewall, DON'T!

At least not yet.

My page of LOUSY advice is at
http://www.seattlecentral.edu/~dmartin/docs/bridge.html

If you're interested in what isn't working and how you might be able to help
me figure it out, read on.

It looks like (and I stress 'looks like') the following scenario is giving
the internal switch a headache.

As background, the bridge interfaces have 'learn' disabled.  That means,
they never cache information about which interface a packet came from.
(The inactive bridge would think all external hosts were attached to 
the internal interface.) 

Internal Host A sends a packet for Internal Host B
Switch receives packet and records which port Host A is connected to.   
Switch's mac address list doesn't contain Host B's Mac address Switch 
        floods the packet out all it's interfaces
Packet arrives at Bridge
Bridge doesn't know where Host B is, and because 'learn' is disabled, it
        also doesn't know where Host A is.  It floods the same packet out 
        all interfaces, including the one the packet came in on.
Packet arrives at Switch
Switch thinks Host A has moved to the port the Bridge is attached to 
        and starts sending all packets intended for Host A to the Bridge
        instead.  This continues until Host A sends out a packet that 
        corrects the Switch's idea of where Host A is.

Right now, I'm playing around with static mac address tables in the switch.
If that fixes it, it will support my theory, but it won't really be a
workable solution.  Maybe I could turn off 'learn' on the switch port
attached to the bridge somehow.  Maybe I could write a pf rule of some kind 
that would make the bridge only pass packets out of interfaces they didn't 
arrive on.

If anyone has any ideas, please let me know.

Thanks
-Dylan Martin
 Unix Admin
 Seattle Central Community College

Reply via email to