per-interface packet filters [summary]

[Andre Oppermann]

Gleb Smirnoff wrote:
> 
> On Tue, Dec 14, 2004 at 01:12:31PM -0500, James wrote:
> J> The way we have approached this in the past is to install /32 host routes
> J> for each interface addr's and respective subnet and broadcast /32 addresses
> J> into the kernel RIB, destined to lo0 interface. Place your per-interface
> J> filter on 'lo0' interface and packets destined to router iteslf will be
> J> subject to loopback filter before making it onto upper layer protocol.
> 
> I was thinking of this idea, too. So, it works?

Yes, it works.  It will work better when the ARP layer 2 information is
removed from the routing table.  This is expected to happen fairly soon
(early next year).

-- 
Andre