Re: Problem with new --physdev-out style

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Patrick McHardy a écrit :
Philip Craig wrote:

Patrick McHardy wrote:

$IPTABLES -A FORWARD -i $BR_GUEST -o $BR_INT -m physdev --physdev-out $IF_DMZ -p tcp --dport 3389 -j ACCEPT

Try adding "--physdev-is-bridged" to your rules. Without that the kernel
is not able to tell whether they apply only to bridged packets or also
to forwarded or locally generated ones.

That won't work for the above rule, for example, since the packet is
being forwarded between two different bridges, so it is not bridged.

Do you mean that the "bridged" flag (or whatever way this is implemented) is not reset when the packet is routed ? Doesn't this sound like a bug ?

I see nothing indicating that it is being forwarded

"-A FORWARD -i $BR_GUEST -o $BR_INT"
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux