Re: Problem with new --physdev-out style

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mi, 24 Okt 2007, Patrick McHardy <kaber@xxxxxxxxx> wrote:
> >This means, that all rules like that are valid even with the new concept
> >of netfilter, right?? But why do I get error messages like quoted in my
> >first mail for these rules - it *is* bridged traffic inside *one*
> >bridge!
> >And: I don't see how --physdev-is-bridged should help, since it's a
> >match and not a command to the kernel saying: "this *is* bridged
> >traffic". It the kernel does not see this by itself,
> >--physdev-is-bridged doesn't help.
> 
> Whether you believe it or not, this is the only way to tell
> the physdev match that the rule only affects purely bridged
> traffic.

Aah, now I get it! This way I can avoid the error message....
Great, I'll test it as soon as I'm back to the lab. 

> Does not work since one of the devices might be put in a different
> bridge after you loaded the rules.

Yes, you're right. 
Then the only solution is to improve the error messages.

> >If no, display a message like this:
> >
> >"physdev match: using --physdev-out in the FORWARD chains is only 
> >allowed if all physical interfaces are members of the same bridge."
> 
> 
> Feel free to send a patch to improve the error messages.

Oh, I'll see if I can patch kernel 2.6.23.1.

Regards
Volker

-- 
  Volker Sauer  *  Poststrasse 1/601   *   64293 Darmstadt  *   Germany
  E-Mail/Jabber: volker(at)volker-sauer.de * http://www.volker-sauer.de
  PGPKey-Fingerprint: DB26 11C7 B12E 0B27 3999 2E4F 7E35 4E4D 5DD5 D0E0
  http://wwwkeys.de.pgp.net/pks/lookup?op=get&search=0x7E354E4D5DD5D0E0 

Attachment: signature.asc
Description: Digital signature


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux