7. Advanced Bridge Features
Here we will cover some advanced features of the new bridge code.
7.1. Spanning Tree Protocol
Tell me...
You are a networkadmin...?
You have a switch on top of your ethernet tree...?
You have nightmares of a switch emmiting smoke...?
Your company is not extremely rich and con provide another redundant switch just waiting for you to plug the patchwires..?
You don't feel like placing your bed close to your main network node to plug the wires...?
Don't wait until you're just another nervous wreck. Join linux bridge community and enjoy the relaxment a stp-enabled inhouse scenario is offering to you.
Ok, let's leave that commercial and get back linux and the bridge. Take a look on this small thread from the linux-bridge mailing list.
STP Thread from bridge@openrock.net (no more valid)
- Could you give me some hints about multi-bridge scenarios.
- Does the STP "heartbeat" mechanism also work with bridges with more than two cards?
- How fast does it get up, and what can I do about it?
You can just set up two "mirrored" bridges. You have two network interfaces in your bridge? Set up the mirror bridge so that it has two network interfaces as well, and connect each of the interfaces to one subnet. This will work without the need of configuration.
Note: Be sure that you have the spanning tree protocol enabled. If you didn't use brctl, this should be fine, because in Linux, it is on by default. To check, you could check whether the bridge sends a packet to 0180c2000000 every 2 seconds. If it does, the STP is on. The STP is needed so that only one bridge will be active at any given time.
Note: To be able to see nicely formatted stp packages in your network take a look at at the bridge homepage for the patches to tcpdump.
The "master" bridge will send out STP packets every 2 seconds by default. The "slave" bridge will receive these packets, and will notice that the master is still up. If the slave hasn't received a packet in 20 seconds (max. message age parameter), it will start the takeover procedure. From the moment the takeover procedure starts, it will take about 30 seconds (twice the forward delay parameter) for the bridge to become fully operational.
Yes, it works with any number of interfaces. You can invent bizarre topologies to your heart's desire. You can use multiple (redundant) bridge-bridge connects, you can insert loops, whatever. The STP code will always find the minimal spanning tree. The bridge code will even deal with the loss of any number of interfaces. If there are two redundant bridges with identical connections, the loss of an interface on one of the bridges will cause the other bridge to take over forwarding to that specific interface. Now isn't that great? :)
If you think 50 seconds is too much -- and I guess you should; alas, the IEEE specs gives us these default values -- you can tweak these parameters. If you set the hello time (the STP packet interval) from 2 to 1 second, you can safely set the message age parameter to 4 seconds. Then you can set the forward delay to 4 seconds, and this will in total give you a takeover time of ~12 seconds.
The great thing which is made possible by STP is a redundant parallel bridging scenario, with automated take over features. Within a network basing on stp the bridges always try to send a datagram the (by path cost) shortest path. Only on that path the bridges are forwarding, all other paths between this shortest way are blocked. If there is a broken path, the bridges agree about the next shortest. So doubled paths don't break the net, but are bringing more security... For a example setup of a fail secured connection see Section 8.
7.2. Bridge And The IP-Chains
The normal idea about a bridge would not allow anything like firewalling, but since several people have asked Lennert for ipchains firewalling on bridge forwarding he implemented it.
Important: If you want to do this, you will need to apply the special ip-chain-bridge-patch (also available at the bridge homepage).
As soon you have everything up correctly, the bridging code will check each to-be-forwarded packet against the ipchains chain which has the same name as the bridge.
So.. if a packet on eth0 is to be forwarded to eth1, and those interfaces are both part of the bridge group br0, the bridging code will check the packet against the chain called 'br0'.
| Warning |
If the chain does not exist, the packet will be forwarded. So if you want to do firewalling, you'll have to create the chain yourself. |
Example 10. A Simple Bridge Firewall Setup
Example: # brctl addbr br0 |
- Creating a bridge interface named br0
- Placing eth0 and eth1 into the bridge.
- Assigning a regular IP address to the bridge. The IP is taken from private network 10.X.X.X (Class A).
- Creating a ip-chain named br0
-
Caution It's vital to have the same name here (br0 or whatever you have selected, as long as you have the same in all places).
- Denying all trafic with source 10.X.X.X on eth0.