[Shorewall-users] DHCP with Maclist

[Julio Torres]

Hello everybody.
I have set up an interface in bridge mode with eth0 and eth1. the
configuration on interfaces: eth0 is connected to the router and eth1 is
connected to local network.

I work with mac verification

MACLIST_TABLE=mangle
MACLIST_DISPOSITION=DROP
On interfaces file I set the maclist on eth1

I have a problem with DHCP on devices when shorewall is running and the
PC's try to connect, they can't get IP

On the Logs only I can see:

[909539.918061] Shorewall:eth1_rec:DROP:IN=br0 OUT= PHYSIN=eth1
MAC=ff:ff:ff:ff:ff:ff:10:15:a1:b3:19:c9:08:00 SRC=0.0.0.0
DST=255.255.255.255 LEN=200 TOS=0x00 PREC=0x00 TTL=1 ID=44061 DF
PROTO=UDP SPT=44559 DPT=1900 LEN=180

is there any configuration that I have to add to let DHCP service?

Thanks

[Simon Hobson]

Post by Julio Torres
Hello everybody.
I have set up an interface in bridge mode with eth0 and eth1. the configuration on interfaces: eth0 is connected to the router and eth1 is connected to local network.
I work with mac verification
MACLIST_TABLE=mangle
MACLIST_DISPOSITION=DROP
On interfaces file I set the maclist on eth1
I have a problem with DHCP on devices when shorewall is running and the PC's try to connect, they can't get IP

I'm not too sure you can filter DHCP. Because it needs to operate when a client doesn't have an address, the server has to use raw sockets to get the broadcast packets from the client. These packets don't (AFAIK) then pass through the IP stack. Also, for this reason I think that the server has to listen on the physical interfaces rather than the bridge - though I'm not too sure of that.

Post by Julio Torres
[909539.918061] Shorewall:eth1_rec:DROP:IN=br0 OUT= PHYSIN=eth1 MAC=ff:ff:ff:ff:ff:ff:10:15:a1:b3:19:c9:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=200 TOS=0x00 PREC=0x00 TTL=1 ID=44061 DF PROTO=UDP SPT=44559 DPT=1900 LEN=180

That's nothing to do with DHCP - AFAICS UDP port 1900 is used for uPnP