Hello, I'm writing a kernel module with a netfilter hook functions at NF_IP_PRE_ROUTING of PF_INET. This is supposed to be processed at IP layer. However, when using ebtables' bridge-nf and enable "/proc/sys/net/bridge/bridge-nf-call-iptables", my hook function will be processed at link layer. The page http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html#section3 says: "For IP packets that get into contact with the bridging code, the br-nf code will decide in which place in the network code the iptables chains will be traversed. Obviously, it is guaranteed that no chain is traversed twice by the same packet." Does this mean the iptables are handled at bridge-nf (NF_HOOK in br_nf_pre_routing()), and ignored at NF_HOOK in ip_rcv()? If the IP pakcets will be passed up to IP layer anyway, will it be better for bridge-nf not to call iptable hook functions, but to let the packets be processed at IP layer? How could I do that? I could not disable "/proc/sys/net/bridge/bridge-nf-call-iptables" to achieve this, because if I disable it, all packets directly bridged (those not up to layer3) will not be processed by iptables rules. Thanks for your help, HUANG Wei -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
