Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > On Wed, Apr 04, 2012 at 09:57:29PM +0200, Florian Westphal wrote: > > if net.bridge.bridge-nf-filter-vlan-tagged sysctl is enabled, bridge > > netfilter removes the vlan header temporarily and then feeds the packet > > to ip(6)tables. > > > > When the new "bridge-nf-pass-vlan-input-device" sysctl is on > > (default off), then bridge netfilter will also change the in/out > > interface to the vlan interface; if such an interface exists. > > > > This is needed to make iptables REDIRECT target work with > > "vlan-on-top-of-bridge" setups. Also, 'iptables -i' can then be used > > to match the vlan device name. > > > > Also update Documentation with current brnf default settings. > > Better to implement a vlan device match for iptables? That would mean that REDIRECT target is unsupported in vlan-on-bridge case. If so, would you accept a man page update that documents this? Thanks, Florian -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
