Overview

Project website docs.freebsd.org/en
Translation license BSD 2-Clause "Simplified" License
Translation process
  • Translations can be made directly.
  • Translation suggestions can be made.
  • Only chosen users can contribute.
  • The translation uses bilingual files.
File mask documentation/content/*/articles/filtering-bridges/_index.po
Translation file Download documentation/content/es/articles/filtering-bridges/_index.po
Last change July 18, 2023, 12:49 p.m.
Last author Fernando Apesteguía

String statistics

Strings percent Hosted strings Words percent Hosted words Characters percent Hosted characters
Total 61 2,592 15,293
Translated 100% 61 100% 2,592 100% 15,293
Needs editing 0% 0 0% 0 0% 0
Read-only 0% 0 0% 0 0% 0
Failing checks 0% 0 0% 0 0% 0
Strings with suggestions 0% 0 0% 0 0% 0
Untranslated strings 0% 0 0% 0 0% 0
Last 12 months Previous

Activity in last 12 months

0 changes 0 changes 0 changes 1 change 1 change 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 16 changes 0 changes 0 changes 2 changes 8 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes 0 changes
Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov

Quick numbers

2,592
Hosted words
61
Hosted strings
100%
Translated
0
Contributors
and previous 30 days

Trends of last 30 days

—
Hosted words
+100%
—
Hosted strings
+100%
—
Translated
+100%
—
Contributors
—
User avatar None

Committed changes

Documentation / articles/filtering-bridges/_index — Spanish

Committed changes 4 months ago
User avatar fernape

Translation changed

Documentation / articles/filtering-bridges/_index — Spanish

There are two rules for passing SMTP and DNS traffic towards the mail server and the name server, if you have them. Obviously the whole rule set should be flavored to personal taste, this is only a specific example (rule format is described accurately in the man:ipfw[8] man page). Note that for "relay" and "ns" to work, name service lookups must work _before_ the bridge is enabled. This is an example of making sure that you set the IP on the correct network card. Alternatively it is possible to specify the IP address instead of the host name (required if the machine is IP-less).
Hay dos reglas para pasar el tráfico SMTP y DNS hacia el servidor de correo y el servidor de nombres si los tienes. Obviamente el conjunto entero de reglas debería estar personalizado al estilo de cada uno, esto es sólo un ejemplo específico (el formato de las reglas está descrito con detalle en la página de manual de man:ipfw[8]). Como alternativa es posible especificar la dirección IP en lugar del nombre del host (requerido si la máquina no tiene IP).
4 months ago
User avatar fernape

Translation changed

Documentation / articles/filtering-bridges/_index — Spanish

Now it is time to create your own file with custom firewall rules, to secure the inside network. There will be some complication in doing this because not all of the firewall functionalities are available on bridged packets. Furthermore, there is a difference between the packets that are in the process of being forwarded and packets that are being received by the local machine. In general, incoming packets are run through the firewall only once, not twice as is normally the case; in fact they are filtered only upon receipt, so rules that use `out` or `xmit` will never match. Personally, I use `in via` which is an older syntax, but one that has a sense when you read it. Another limitation is that you are restricted to use only `pass` or `drop` commands for packets filtered by a bridge. Sophisticated things like `divert`, `forward` or `reject` are not available. Such options can still be used, but only on traffic to or from the bridge machine itself (if it has an IP address).
Ahora es el momento de crear tu propio archivo de configuración con las reglas personalizadas del firewall para proteger la red interna. Te encontrarás con algunas complicaciones porque no todas las funcionalidades del firewall están disponibles en los paquetes bridge. Hay además una diferencia entre los paquetes que están en proceso de reenvío y los paquetes que estás recibiendo la máquina local. En general, los paquetes de entrada pasan por el firewall solo una vez, no dos veces, como suele ser el caso; en realidad se filtran solo después de la recepción, por lo que las reglas que usan `out` o `xmit` nunca coincidirán. Yo utilizo`in via`, que es una sintaxis más antigua pero tiene sentido cuando la lees. Otra limitación es que solo puedes usar solo los comandos `pass` o `reject` para los paquetes filtrados por un bridge. Opciones más complejas como `divert`, `forward` o `reject` no están disponibles. Estas opciones pueden seguir utilizándose, pero solo en el tráfico hacia o desde la propia máquina bridge (si tiene una dirección IP).
4 months ago
User avatar fernape

Translation changed

Documentation / articles/filtering-bridges/_index — Spanish

At this point you should be able to insert the machine between two sets of hosts without compromising any communication abilities between them. If so, the next step is to add the `net.link.ether.bridge._[blah]_=_[blah]_` portions of these rows to the [.filename]#/etc/sysctl.conf# file, to have them execute at startup.
En este punto deberías poder insertar la máquina entre dos conjuntos de hosts sin comprometer las habilidades de comunicación entre ellas. Si es así, el siguiente paso es añadir las partes `net.link.ether.bridge._[blah]_=_[blah]_` de estas filas al fichero [.filename]#/etc/sysctl.conf# para que se ejecuten en el arranque.
4 months ago
User avatar fernape

Translation changed

Documentation / articles/filtering-bridges/_index — Spanish

There is another important thing to know. When running IP over Ethernet, there are actually two Ethernet protocols in use: one is IP, the other is ARP. ARP does the conversion of the IP address of a host into its Ethernet address (MAC layer). To allow the communication between two hosts separated by the bridge, it is necessary that the bridge will forward ARP packets. Such protocol is not included in the IP layer, since it exists only with IP over Ethernet. The FreeBSD firewall filters exclusively on the IP layer and therefore all non-IP packets (ARP included) will be forwarded without being filtered, even if the firewall is configured to not permit anything.
Hay otra cosa importante que hay que saber. Cuando se ejecuta IP over Ethernet, en realidad hay dos protocolos Ethernet en uso: uno es IP, el otro es ARP. ARP realiza la conversión de la dirección IP de un host a su dirección de Ethernet (capa MAC). Para permitir la comunicación entre dos hosts separados por el bridge, es necesario que el bridge reenvíe los paquetes ARP. Dicho protocolo no está incluido en la capa IP, ya que solo existe con IP over Ethernet. El firewall de FreeBSD filtra exclusivamente en la capa IP y, por lo tanto, todos los paquetes no IP (ARP incluido) se reenvían sin ser filtrados, aunque el firewall esté configurado para no permitir nada.
4 months ago
User avatar fernape

Translation changed

Documentation / articles/filtering-bridges/_index — Spanish

Before rebooting to load the new kernel or the required modules (according to the previously chosen installation method), you have to make some changes to the [.filename]#/etc/rc.conf# configuration file. The default rule of the firewall is to reject all IP packets. Initially we will set up an `open` firewall, to verify its operation without any issue related to packet filtering (in case you are going to execute this procedure remotely, such configuration will avoid you to remain isolated from the network). Put these lines in [.filename]#/etc/rc.conf#:
Antes de reiniciar para cargar el nuevo kernel o los módulos requeridos (de acuerdo con el método de instalación elegido anteriormente) debes realizar algunos cambios en el archivo de configuración [.filename]#/etc/rc.conf#. La regla predeterminada del firewall es rechazar todos los paquetes IP. Inicialmente configuraremos un firewall en modo `open` para verificar que funciona sin ningún problema en relación con el filtrado de paquetes (en el caso de que vaya a ejecutar este procedimiento de forma remota dicha configuración evitará que permanezca aislado de la red). Coloca estas líneas en el archivo [.filename]#/etc/rc.conf#:
4 months ago
User avatar fernape

Translation changed

Documentation / articles/filtering-bridges/_index — Spanish

Before going on, be sure to have at least two Ethernet cards that support the promiscuous mode for both reception and transmission, since they must be able to send Ethernet packets with any address, not just their own. Moreover, to have a good throughput, the cards should be PCI bus mastering cards. The best choices are still the Intel EtherExpress(TM) Pro, followed by the 3Com(R) 3c9xx series. To simplify the firewall configuration it may be useful to have two cards of different manufacturers (using different drivers) to distinguish clearly which interface is connected to the router and which to the inner network.
Antes de continuar asegúrese de tener al menos dos tarjetas Ethernet que admitan el modo promiscuo tanto para la recepción como para la transmisión, ya que deben poder enviar paquetes Ethernet con cualquier dirección, no solo la suya. Además, para tener una buena tasa de transferencia, las tarjetas deben ser tarjetas del bus PCI. Las mejores opciones siguen siendo Intel EtherExpress(TM) Pro, seguida de la 3Com(R) 3c9xx series. Para simplificar la configuración del firewall, puede ser útil tener dos tarjetas de diferentes fabricantes (con diferentes controladores) para distinguir claramente qué interfaz está conectada al router y cuál a la red interna.
4 months ago
User avatar fernape

Translation changed

Documentation / articles/filtering-bridges/_index — Spanish

Often it is useful to divide one physical network (like an Ethernet) into two separate segments without having to create subnets, and use a router to link them together. The device that connects the two networks in this way is called a bridge. A FreeBSD system with two network interfaces is enough to act as a bridge.
A menudo es útil dividir una red física (por ejemplo una Ethernet) en dos segmentos separados sin tener que crear subredes y usar un router para vincularlas. El dispositivo que conecta las dos redes se llama bridge. Un sistema FreeBSD con dos interfaces de red es suficiente para actuar como bridge.
4 months ago
User avatar None

New strings to translate

Documentation / articles/filtering-bridges/_index — Spanish

7 new strings to translate appeared to the translation. 6 months ago
User avatar None

Resource update

Documentation / articles/filtering-bridges/_index — Spanish

The "documentation/content/es/articles/filtering-bridges/_index.po" file was changed. 6 months ago
Browse all translation changes