On 06/07/07 01:55, Greg Scott wrote:
I might see if I can do this with one set of rules in the PREROUTING
chain.
That is exactly why I put the rules in a new chain and jumped to the
chain. One place to maintain them. With the ability to jump to the
chain and then return to the chain that you jumped from, things act more
like a sub-routine in programming.
- Create new chains with a default policy of RETURN.
- DROP on failures with in the new chain.
- Default policy of RETURN will return packet flow to the calling chain.
- Jump to the new chain from INPUT and return from it if everything is ok.
- Jump to the new chain from FORWARD and return from it if everything
is ok.
In fact, you could use the new chain as a (sub)chain from any chain with
in the filter table.
Yup - I noticed similar behavior. So this is how I'll handle it.
eth0 gets an IP Address of 1.2.3.6 during normal bootup. And then
when I do the brctl stuff, br0 gets 1.2.3.2. That way there's never
a conflict between the physical and logical. All the physical
interfaces have unique addresses so I can route based on the address
when it makes sense, or bridge based on the interface when that makes
sense. I'm feeling lots better about all this. Hopefully this
discussion can help others out there.
This is one way to do it. Just be careful of race conditions while you
are bringing things up.
Grant. . . .
_______________________________________________
LARTC mailing list
LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
