Torsten, I suffered a similar problem and was wondering if you found a better solution to the problem of dnatting on a transparent bridge. My setup: INTERNET <-> ROUTER <-> (linux)BRIDGE <-> INTERNAL NETWORK Solution: setup a bridge with ip x.x.x.51 and alias another ip to the bridge x.x.x.50 ( using a /16 network at home ) Now get the router to send all incomming traffic to .50 DNAT traffic you want on your bridge to .51 and other traffic to say .101 Now it works .. very strange, hey works here. <-------------------- rules ------------------------------> iptables -t nat -N toZeus iptables -t nat -I toZeus -m physdev --physdev-in eth1 \ -s ! x.x.0.0/16 -j DNAT --to x.x.x.51 iptables -t nat -N toHerc iptables -t nat -I toHerc -m physdev --physdev-in eth1 \ -s ! x.x.0.0/16 -j DNAT --to x.x.x.101 iptables -t nat -I PREROUTING -p tcp -m multiport \ -d x.x.x.50 --destination-ports \ ftp,sftp,ssh,smtp,ssmtp,http,pop3,pop3s,imap,imaps \ -j toZeus iptables -t nat -I PREROUTING -p udp -m multiport \ -d x.x.x.50 --destination-ports 41111 -j toHerc iptables -t nat -I PREROUTING -p tcp -m multiport \ -d x.x.x.50 --destination-ports 41111 -j toHerc <-------------------- end rules ---------------------------> I just joined this list sorry, if I missed the solution. Michiel Brandenburg
