View source for Bering-uClibc 6.x - User Guide - Advanced Topics - Setting Up a Bridge

{| summary="Navigation header" width="100%"
! colspan="3" align="center" | [[Bering-uClibc 6.x - User Guide - Advanced Topics - Setting Up a Bridge|Advanced Topics - Setting Up a Bridge]]
|-
| width="20%" align="left"   | [[Bering-uClibc 6.x - User Guide - Advanced Topics - Setting Up a RADIUS Server|Prev]]
! width="60%" align="center" | [[Bering-uClibc 6.x - User Guide]]
| width="20%" align="right"  | [[Bering-uClibc 6.x - User Guide - Advanced Topics - Setting Up a Network Emulator|Next]]
|}
----


==Objectives==
We assume here that you want to implement a [[Bering-uClibc 6.x]] machine as an Ethernet "Bridge" which connects together two Ethernet network segments at Layer 2 of the OSI model.
This can be desirable for a number of reasons:
* To overcome the physical limitations of Ethernet installations (such as maximum cable lengths).
* In order to implement some sort of processing or filtering of traffic passing through the bridge:
** Emulation of WAN characteristics on a LAN link.
** Quality of Service or Bandwidth Management.

'''Note: ''' This procedure configures [[Bering-uClibc 6.x]] as a Bridge rather than a Router and hence firewalling cannot be done with Shorewall.
Bridge supports only filtering on the FORWARD Chain. Shorewall defines rules on input, output, forward and its own tables. If the custom built tables get packets redirected from the FORWARD table, filtering would work. If Shorewall based firewalling is also needed, then the bridge should be replaced by a ARP Proxy set-up. This setup is, however, simpler to configure and manage.

Importance of such a configuration: If we were to plug a LEAF box in as a bandwidth manager or a firewall and can do so in a transparent fashion - meaning none of the computers need to be reconfigured in any form for IP gateways or subnets. This makes it easy to plug this in and out of a production network without users realizing except for maybe throttling of bandwidth. This also improves the capability to provide greater uptimes.

==Step 1: Declare the <code class="filename">bridge.lrp</code> Package==
The <code class="filename">bridge.lrp</code> Package implements the '''brctl''' command and also <tt>if-up</tt> and <tt>if-down</tt> hooks.

Add the <tt>bridge</tt> Package to the <tt>LRP</tt> list in <code class="filename">leaf.cfg</code> as described in the [[Bering-uClibc 6.x - User Guide - Basic Configuration - LEAF Packages|LEAF Packages]] Chapter.

==Step 2: Install the kernel Modules==
In order to have the bridge working, you need to have bridging support enabled through the appropriate kernel Modules.

You also need to load the driver Module of the network cards assigned to your "External" and "Internal" network links.
With [[Bering-uClibc 6.x]] this is most easily accomplished by using the automatic hardware detection facility described in the [[Bering-uClibc 6.x - User Guide - Basic Configuration - Basic System Configuration|Basic System Configuration]] Chapter.

The extra kernel Modules which implement the bridging functionality need to be declared in <code class="filename">/etc/modules/</code>.
Once present in this file they will be loaded during boot.

Add the necessary modules to <code class="filename">/etc/modules/</code>:
* <code class="filename">bridge</code>
* <code class="filename">llc</code>
* <code class="filename">stp</code>

==Step 3: Configure the bridge system==
Invoke '''lrcfg''' and choose <tt>1) Network configuration</tt> and then <tt>1) Network Interfaces</tt>. In the interface file, comment out all lines except those for the bridge (also leave the "loopback" lines un-commented):
 <nowiki>(...)
 #Step 4 (optional): configure a bridge
 auto br0
 iface br0 inet static
        address 192.168.1.254
        netmask 255.255.255.0
        broadcast 192.168.1.255
        bridge_ports all
 </nowiki>

The address is not mandatory for the system to work as a bridge but will be necessary if you want to log into the system and manage / configure / monitor the system over the network.

'''Note:''' Please remember that all other auto configuration and address configurations for all other interfaces should be commented out as they become slaves to the bridge and do not have an individual identity.

==Step 4: Check if the bridge is working properly==
Save the configuration (through the LEAF backup menu entry - remember to save the Modules as well as the Configuration).
Physically connect the bridge machine into the network.

Reboot, the system should show a message similar to:
 Configuring network interfaces: Waiting for br0 to get ready (MAXWAIT is 30 seconds).

In logfile <code class="filename">/var/log/messages</code> you should see messages similar to the following:
 Bridge firewalling registered
 NET: Registered protocol family 10
 device eth0 entered promiscuous mode
 e100 0000:00:0a.0: eth0: NIC Link is Up 100 Mbps Full Duplex
 ADDRCONF(NETDEV_UP): eth0: link is not ready
 ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
 device eth1 entered promiscuous mode
 eth1: DSPCFG accepted after 0 usec.
 eth1: link up.
 eth1: Setting full-duplex based on negotiated link capability.
 br0: port 2(eth1) entering learning state
 br0: port 2(eth1) entering learning state
 br0: port 1(eth0) entering learning state
 br0: port 1(eth0) entering learning state
 br0: port 2(eth1) entering forwarding state
 br0: port 1(eth0) entering forwarding state

Try to ping the gateway from any system. If the ping goes through well, the bridge is working properly. If not, check the cables and the type of cable used. If a straight cable is used between the Bering-uClibc box and the router, switch it for a crossed cable and re-try the ping.

Try the following command:
 ip addr show dev br0
A device called <tt>br0</tt> should show up with the IP address details configured.

'''Note:''' The bridge to router cable would need to be a straight CAT5 cable as switch to router would normally be a crossed cable. It would do good to have a straight and a crossed cable handy so that both can be tried out.

==Step 5: Using the utilities==
<code class="filename">bridge.lrp</code>, when installed, provides <code class="filename">if-up</code> and <code class="filename">if-down</code> files for the bridge to enable custom scripts to run - one good example may be sending mails out to indicate up and down status of the interface.

<span class="emphasis">''brctl''</span> is the bridge control utility. <span class="emphasis">''brctl show''</span> shows all bridges with enslaved interfaces. Since this is most likely the only bridge, you can switch the Spanning Tree Protocol off by giving:
 brctl br0 stp off


----
{| summary="Navigation footer" width="100%"
| width="40%" align="left"   | [[Bering-uClibc 6.x - User Guide - Advanced Topics - Setting Up a RADIUS Server|Prev]]
| width="20%" align="center" | [[Bering-uClibc 6.x - User Guide - Advanced Topics|Up]]
| width="40%" align="right"  | [[Bering-uClibc 6.x - User Guide - Advanced Topics - Setting Up a Network Emulator|Next]]
|}

[[Category:Bering-uClibc 5.x]]
[[Category:User Guide]]