Given 3 ethernet interfaces, I'd like to accomplish this:eth0 -> WANeth1 -> EAPoL authenticatoreth2 -> IP Nat to private networkIn this scenario, I would like ebtables to filter and forward ethernet frames of type 0x888E (EAPoL) to/from the WAN through eth1 which will have the EAPoL authenticator connected. The remaining traffic I would like to IP NAT to eth2.I was reading about brouting here:http://ebtables.netfilter.org/examples/basic.html#ex_brouterThough it's not clear how I use the above for layer 2 filtering.Instead, what i've tried so far was to create a bridge with eth0 and eth1 and then an ebtables filtering rule so that only EAPoL traffic arrives on eth1:ebtables -t filter -A FORWARD -i eth0 -p 0x888e -j ACCEPTebtables -t filter -A FORWARD -i eth0 -j DROPebtables -t filter -A FORWARD -o eth0 -p 0x888e -j ACCEPTebtables -t filter -A FORWARD -o eth0 -j DROPThen I IP NAT between eth0 and eth2:iptables -t nat -A POSTROUTING -o eth0-j MASQUERADEiptables -A FORWARD -i eth2 -j ACCEPTunfortunately, I can't get BOTH of these to work at the same time, only one or the other.Any ideas? Appreciate any thoughts or tips
Linux brouting with ebtables, filter and forward EAPoL frames
linux;iptables;ethernet