Bart De Schuymer

The ebtables program is an open-source filtering tool for a Linux-based bridging firewall. It enables transparent filtering of network traffic passing through a Linux bridge. The filtering possibilities are limited to link-layer filtering and some basic filtering on higher network layers. Advanced logging, MAC DNAT/SNAT, and brouter facilities are also included.

The ebtables tool can be combined with the other Linux filtering tools (iptables, ip6tables, and arptables) to make a bridging firewall that is also capable of filtering these higher network layers. This is enabled through the bridge-Netfilter architecture which is a part of the standard Linux kernel.

Although Bart is the main author of this technology, he has handed over ownership and maintenance to the Netfilter project.

A transparent system hosted on a Linux operating system for locally intercepting, possibly altering, and retransmitting IP datagrams. The packet alteration consists primarily of replacing a sequence of bytes in the IP payload by an equal amount of other bytes. The IP datagrams are inspected by a userspace program and this program does the required replacements. A template implementation in C was provided.

Porting an existing firewall application to a specific Linux kernel. The existing functionality was extended with IPv6 address filtering similar to the already existing IPv4 address filtering. Source code and a detailed design document were provided.

The set up of a bridged Linux environment in which UDP packets are delivered to a userspace program instead of being bridged. This includes a userspace library that can be used to read these packets. Functionality was also provided to easily set up the receive and transmit sockets for the UDP traffic between Sevis devices. Finally, the functionality to retransmit raw Ethernet frames over the bridge ports was also provided. Source code and detailed documentation were provided.