My redundant bridging firewall don't work no more with 3.6! Hi folks, a while back I set up a redundant bridging firewall and I wrote up a web page describing how it works. Well, now that I've upgraded to 3.6, I've discovered it doesn't work any more. So! If you were going to follow the directions in my web page to build a redundant bridging firewall, DON'T!
At least not yet. My page of LOUSY advice is at http://www.seattlecentral.edu/~dmartin/docs/bridge.html If you're interested in what isn't working and how you might be able to help me figure it out, read on. It looks like (and I stress 'looks like') the following scenario is giving the internal switch a headache. As background, the bridge interfaces have 'learn' disabled. That means, they never cache information about which interface a packet came from. (The inactive bridge would think all external hosts were attached to the internal interface.) Internal Host A sends a packet for Internal Host B Switch receives packet and records which port Host A is connected to. Switch's mac address list doesn't contain Host B's Mac address Switch floods the packet out all it's interfaces Packet arrives at Bridge Bridge doesn't know where Host B is, and because 'learn' is disabled, it also doesn't know where Host A is. It floods the same packet out all interfaces, including the one the packet came in on. Packet arrives at Switch Switch thinks Host A has moved to the port the Bridge is attached to and starts sending all packets intended for Host A to the Bridge instead. This continues until Host A sends out a packet that corrects the Switch's idea of where Host A is. Right now, I'm playing around with static mac address tables in the switch. If that fixes it, it will support my theory, but it won't really be a workable solution. Maybe I could turn off 'learn' on the switch port attached to the bridge somehow. Maybe I could write a pf rule of some kind that would make the bridge only pass packets out of interfaces they didn't arrive on. If anyone has any ideas, please let me know. Thanks -Dylan Martin Unix Admin Seattle Central Community College
