桥接双接口并分流流量：SCADA系统白帽改造IP共享方案咨询

Alright, let's break this down for your legacy SCADA bridge scenario—you need IP sharing, traffic filtering, and all on a low-power router that can't rely on DHCP. Here's a practical, step-by-step solution:

1. Fix IP Sharing with Proxy ARP #

Since your environment lacks DHCP, the key to sharing the SCADA system's IP with your router is proxy ARP. This lets your router act as a "middleman" that responds to ARP requests for the SCADA IP, while still forwarding traffic to the actual SCADA device. It also lets you use the same IP to access the router for management.

First, clean up any existing bridge config (if you already ran the initial commands):

ip link set dev eth0 nomaster
ip link set dev eth1 nomaster
ip link set dev br0 down
ip link delete br0

Now set up the bridge with proxy ARP enabled:

# Create the bridge interface
ip link add name br0 type bridge

# Enable proxy ARP on the bridge (critical for IP sharing)
sysctl -w net.ipv4.conf.br0.proxy_arp=1

# Disable ARP notifications to avoid IP conflict alerts
sysctl -w net.ipv4.conf.br0.arp_notify=0

# Bring the bridge up
ip link set dev br0 up

# Attach your physical Ethernet ports to the bridge
ip link set dev eth0 master br0
ip link set dev eth1 master br0

# Assign the SAME IP as your SCADA system to the bridge (replace with your actual IP/mask)
ip address add 192.168.1.20/24 dev br0

2. Implement Traffic Shaping/Filtering #

Since this is a layer 2 bridge, you can use either ebtables (for layer 2 rules) or iptables (by enabling bridge-nf calls) to split or filter traffic. Here are two common use cases:

Option A: Redirect Specific Traffic to Router Services #

If you want to siphon traffic (like Modbus port 502) to a local monitoring/security service on the router:

# Let iptables process bridge traffic
sysctl -w net.bridge.bridge-nf-call-iptables=1

# Redirect incoming SCADA port 502 traffic to your router's local port 1502
iptables -t nat -A PREROUTING -i br0 -d 192.168.1.20 --dport 502 -j DNAT --to-destination 127.0.0.1:1502

# Ensure return traffic gets mapped back to the SCADA IP
iptables -t nat -A POSTROUTING -o br0 -s 127.0.0.1 --sport 1502 -j SNAT --to-source 192.168.1.20

# Allow established/related traffic to pass through
iptables -A FORWARD -i br0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT

Option B: Mirror Traffic for Monitoring #

If you just need to copy traffic to a monitoring tool (without altering the original flow):

# Use ebtables to mirror all traffic from eth0 to eth1 (adjust interfaces as needed)
ebtables -t nat -A PREROUTING -i eth0 -j mirror --out-interface eth1

3. Persist Configs for Reboot #

Since this is a field-deployed router, you need these settings to stick after a reboot. Add the commands to your router's startup script:

• For OpenWrt-based routers: Add them to /etc/rc.local before exit 0
• For Debian/Ubuntu-based systems: Create a simple systemd service or add to /etc/rc.local

Key Notes for Low-Power Operation #

All these configs run in the kernel, so they use minimal CPU/RAM—perfect for your 0.5V/<100mA router. Just avoid running heavy user-space services alongside them.

内容的提问来源于stack exchange，提问作者Gabe