On Mi, 24 Okt 2007, Patrick McHardy <kaber@xxxxxxxxx> wrote: > >This means, that all rules like that are valid even with the new concept > >of netfilter, right?? But why do I get error messages like quoted in my > >first mail for these rules - it *is* bridged traffic inside *one* > >bridge! > >And: I don't see how --physdev-is-bridged should help, since it's a > >match and not a command to the kernel saying: "this *is* bridged > >traffic". It the kernel does not see this by itself, > >--physdev-is-bridged doesn't help. > > Whether you believe it or not, this is the only way to tell > the physdev match that the rule only affects purely bridged > traffic. Aah, now I get it! This way I can avoid the error message.... Great, I'll test it as soon as I'm back to the lab. > Does not work since one of the devices might be put in a different > bridge after you loaded the rules. Yes, you're right. Then the only solution is to improve the error messages. > >If no, display a message like this: > > > >"physdev match: using --physdev-out in the FORWARD chains is only > >allowed if all physical interfaces are members of the same bridge." > > > Feel free to send a patch to improve the error messages. Oh, I'll see if I can patch kernel 2.6.23.1. Regards Volker -- Volker Sauer * Poststrasse 1/601 * 64293 Darmstadt * Germany E-Mail/Jabber: volker(at)volker-sauer.de * http://www.volker-sauer.de PGPKey-Fingerprint: DB26 11C7 B12E 0B27 3999 2E4F 7E35 4E4D 5DD5 D0E0 http://wwwkeys.de.pgp.net/pks/lookup?op=get&search=0x7E354E4D5DD5D0E0
Attachment:
signature.asc
Description: Digital signature
