passing DHCP requests with ebtables

[mattinnc]

I'm trying to find a way to have the Guest wireless get it's IP address from the DHCP server on the intranet but not allow any other access to the intranet.

I'm running the RT-AC66R with Merlin's build 3.0.0.4.374.39 in router mode. I know I can change the Access Intranet to On in the settings but this allows too much access.

I've read the other similar posts and found the ebtables status with the Access Intranet enabled or disabled. It seems the correct ebtables statements should be able to allow the DHCP requests but block other traffic. Unfortunately I've been unable to make it work. I'm hoping that someone, with a better understanding of ebtables might be able to offer some assistance and thoughts.

When the Access Intranet is Off. These statements exists in ebtables:

Bridge table: filter
Bridge chain: FORWARD, entries: 2, policy: ACCEPT
-i wl0.1 -j DROP 
-o wl0.1 -j DROP

Bridge table: broute
Bridge chain: BROUTING, entries: 1, policy: ACCEPT
-p IPv4 -i wl0.1 --ip-dst 192.168.55.0/24 --ip-proto tcp -j DROP

If the Access Intranet is On, both of those statements are missing, essentially ebtables is empty.

I seems like it should be possible to add a statement(s) ahead of these statements that would allow DHCP traffic (ports 67 & 68) to pass. Anyone have an idea??

Thanks in advance!

 

[Martineau]

I'm trying to find a way to have the Guest wireless get it's IP address from the DHCP server on the intranet but not allow any other access to the intranet.

I'm running the RT-AC66R with Merlin's build 3.0.0.4.374.39 in router mode. I know I can change the Access Intranet to On in the settings but this allows too much access.

I've read the other similar posts and found the ebtables status with the Access Intranet enabled or disabled. It seems the correct ebtables statements should be able to allow the DHCP requests but block other traffic. Unfortunately I've been unable to make it work. I'm hoping that someone, with a better understanding of ebtables might be able to offer some assistance and thoughts.

When the Access Intranet is Off. These statements exists in ebtables:

Bridge table: filter
Bridge chain: FORWARD, entries: 2, policy: ACCEPT
-i wl0.1 -j DROP 
-o wl0.1 -j DROP

Bridge table: broute
Bridge chain: BROUTING, entries: 1, policy: ACCEPT
-p IPv4 -i wl0.1 --ip-dst 192.168.55.0/24 --ip-proto tcp -j DROP

If the Access Intranet is On, both of those statements are missing, essentially ebtables is empty.

I seems like it should be possible to add a statement(s) ahead of these statements that would allow DHCP traffic (ports 67 & 68) to pass. Anyone have an idea??

Thanks in advance!

Does this post not provide the solution?

http://forums.smallnetbuilder.com/showpost.php?p=100435&postcount=39

...it appears to force Guests to obtain a DHCP from a designated DHCP server on the intranet but does not allow those Guests access to the intranet for other access.

Regards,

 

[mattinnc]

Actually I had looked at that post quite a bit but it does not do what I'd like to accomplish. His post uses dnsmasq to create a dhcp scope for use on the quest wireless.

I think it could be done even simpler. I dont think you need to change the IPTables as it does not appear to get changed when the ebtables are changed. Also I did discover with the Acess Intranet Off, I could flush just the bridge filter...

ebtables --flush

and this would allow the guest access to the Intranet. The broute table was not changed, so this could indicate that I can add only a statement to the bridge filter and allow only DHCP requests, I'm thinking nothing else needs to change.

 

[mattinnc]

Solved

I finally figured it out! I was able to add two lines to ebtables that allowed the DHCP server to supply IP's to the Guest wireless clients without giving them any other access to the Intranet.

I added the following two lines to the firewall-start script so it survives a reboot.

ebtables -I FORWARD -i wl0.1 -p ipv4 --ip-proto udp --ip-destination-port 67:68 -j ACCEPT
ebtables -I FORWARD -o wl0.1 -p ipv4 --ip-proto udp --ip-source-port 67:68 -j ACCEPT

This produces a ebtables filter that now looks like this:

Bridge table: filter
Bridge chain: FORWARD, entries: 4, policy: ACCEPT
-p IPv4 -o wl0.1 --ip-proto udp --ip-sport 67:68 -j ACCEPT , pcnt = 21 -- bcnt = 7080
-p IPv4 -i wl0.1 --ip-proto udp --ip-dport 67:68 -j ACCEPT , pcnt = 12 -- bcnt = 4056
-i wl0.1 -j DROP , pcnt = 378 -- bcnt = 52818
-o wl0.1 -j DROP , pcnt = 539 -- bcnt = 65976

I did nothing to alter the ebtables broute filter.

It works very nicely with the exception of the DNS queries, they are not able to access the local DNS server so I had to add the OpenDNS server to the scope. I'd like to find a cleaner way to either pass the DNS packets or use dnsmasq to handle the requests.

Thanks to Merlin for the great firmware and all the users on this forum that provide some really great help.