Patrick McHardy wrote: >> $IPTABLES -A FORWARD -i $BR_GUEST -o $BR_INT -m physdev --physdev-out $IF_DMZ -p tcp --dport 3389 -j ACCEPT > > Try adding "--physdev-is-bridged" to your rules. Without that the kernel > is not able to tell whether they apply only to bridged packets or also > to forwarded or locally generated ones. That won't work for the above rule, for example, since the packet is being forwarded between two different bridges, so it is not bridged. The only solution I am aware of is to stop bridging and use routing and arp proxy. - To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
