Re: Problem with new --physdev-out style

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Patrick McHardy wrote:
> Philip Craig wrote:
>> Patrick McHardy wrote:
>>>> $IPTABLES -A FORWARD -i $BR_GUEST -o $BR_INT -m physdev --physdev-out $IF_DMZ -p tcp --dport 3389 -j ACCEPT
>>> Try adding "--physdev-is-bridged" to your rules. Without that the kernel
>>> is not able to tell whether they apply only to bridged packets or also
>>> to forwarded or locally generated ones.
>> That won't work for the above rule, for example, since the packet is
>> being forwarded between two different bridges, so it is not bridged.
> 
> 
> I see nothing indicating that it is being forwarded.

They are different bridges, BR_GUEST and BR_INT, doesn't that mean it must
be forwarded?

> bridge-netfilter
> passes packets though the iptables hooks by default.

Yes, but if the destination is a different bridge then isn't it passed up
to the IP layer without going through NF_BR_FORWARD, and so BRNF_BRIDGED
is never set?  And more importantly, nf_bridge->physoutdev is never set
until the output bridge processes it.

-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux