kernel 2.6.9 에서 Bridge Firewall 설정 문의드립니다.

제 경우엔 fedora core3 를 설치후 bridge-utils 도 RPM으로 설치해서 사용중입니다.
링크거신 문서에 다 나와 있는 내용입니다만 제가 사용중인 설정을 올리니 참고하세요.

일단 브릿지는 아래처럼 구성했고 내부 네트워크에서만 접속되도록 서버 IP를 10.50.0.1 로 지정해두었습니다.

cat /etc/init.d/bridge 
#! /bin/bash
#
# bridge       Bring up/down bridge
#
# chkconfig: 2345 9 91
# description: Activates/Deactivates all bridge interfaces configured to \
#              start at boot time.
# probe: true
### BEGIN INIT INFO
# Provides: $bridge
### END INIT INFO

# See how we were called.
case "$1" in
  start)
        brctl addbr br
        brctl addif br eth0
        brctl addif br eth1
        /sbin/ifconfig eth0 0.0.0.0 up
        /sbin/ifconfig eth1 0.0.0.0 up
        /sbin/ifconfig br up
        /sbin/ifconfig br 10.50.0.1 up
        ;;
  stop)
        brctl delif br eth1
        brctl delif br eth0
        brctl delbr br
        ;;
  status)
        brctl showmacs br
        ;;
  restart|reload)
        cd $CWD
        $0 stop
        $0 start
        ;;
  *)
        echo $"Usage: $0 {start|stop|restart|reload|status}"
        exit 1
esac

exit 0

iptables 은 아래처럼 설정해두었습니다.

cat /etc/sysconfig/iptables
# Generated by iptables-save v1.2.9 on Thu Dec  9 10:08:33 2004
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [242:27601]
:OUTPUT ACCEPT [4445:1628609]
:RH-Firewall-1-INPUT - [0:0]

################################################################################
# Chain create
################################################################################
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT


################################################################################
# Public
################################################################################
# 잘못된 패킷 차단
#-A RH-Firewall-1-INPUT -m state --state INVALID -j DROP

# 로컬호스트에서의 모든패킷허용
-A RH-Firewall-1-INPUT -i lo -j ACCEPT

# 서브넷에서의 내,외부로 모든패킷허용
-A RH-Firewall-1-INPUT -s 211.212.213.0/255.255.255.0 -j ACCEPT

# 서브넷에서의 내,외부로 ping 허용
-A RH-Firewall-1-INPUT -s 211.212.213.0/255.255.255.0 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.50.0.0/24 -p icmp -m icmp --icmp-type 8 -j ACCEPT

# 내부에서 외부로 나가는 tcp 모두허용
-A RH-Firewall-1-INPUT -p tcp -m tcp --sport 20 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state ESTABLISHED -m tcp --sport 1:65535 --dport 1:65535 -j ACCEPT

# 내부서브넷에서 외부로 나가는 udp 모두허용
-A RH-Firewall-1-INPUT -p udp -m udp --sport 1:65535 -j ACCEPT


################################################################################
# Firewall level
################################################################################
# SSH
-A RH-Firewall-1-INPUT -d 10.50.0.1 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 22 -j ACCEPT

# ntop
-A RH-Firewall-1-INPUT -d 10.50.0.1 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 3000 -j ACCEPT


################################################################################
# Desktop level
################################################################################
# MSN
-A RH-Firewall-1-INPUT -p tcp -d 211.212.213.0/255.255.255.0 --dport 1863:1864 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 211.212.213.0/255.255.255.0 --dport 6901 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 211.212.213.0/255.255.255.0 --dport 7801:7825 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -d 211.212.213.0/255.255.255.0 --dport 6891:6900 -j ACCEPT

# edonkey
-A RH-Firewall-1-INPUT -p tcp -d 211.212.213.0/255.255.255.0 --dport 4662 -j ACCEPT


################################################################################
# Server level
################################################################################

# SMTP/WWW/POP3
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 110 -j ACCEPT

# DNS
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p udp -m udp --dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 53 -j ACCEPT

# SSH
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 22 -j ACCEPT

# Samba
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 139 -j ACCEPT

# 윈도우 네트워크 드라이브
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 139 -j ACCEPT
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 445 -j ACCEPT
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p udp -m state --state NEW,ESTABLISHED -m udp --dport 137 -j ACCEPT
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p udp -m state --state NEW,ESTABLISHED -m udp --dport 138 -j ACCEPT

# FTP
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state RELATED,ESTABLISHED -m tcp --dport 20 -j ACCEPT
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 21 -j ACCEPT

# ms-sql
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 1433 -j ACCEPT
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m udp --dport 1433 -j ACCEPT

# oracle
#-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 1522 -j ACCEPT

# Terminal service
-A RH-Firewall-1-INPUT -d 211.212.213.214 -p tcp -m state --state NEW,ESTABLISHED -m tcp --dport 3389 -j ACCEPT


################################################################################
# DROP
################################################################################

# 외부에서 내부로의 TCP 를 차단.  내부에서 외부로의 TCP 는 막지않음.
-A RH-Firewall-1-INPUT -p tcp --syn -d 211.212.213.0/255.255.255.0 -j DROP

# ping 차단
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type 8 -j REJECT --reject-with icmp-port-unreachable

COMMIT
# Completed on Thu Dec  9 10:08:33 2004