On 13/04/2012 08:06, hannah commodore wrote: > On Thu, Apr 12, 2012 at 00:58, Marc <ccc@xxxxxxxxxxxxx> wrote: >> I was/am trying to setup packet filtering on a virtualisation host and >> couldnt get it to work and was hoping for some pointers. >> >> Heres the setup: >> >> Said host has: >> eth0 - the physical interface, no address assigned >> br0 - the bridge interface, has IP 10.0.0.1 and gateway and default >> route assigned to it >> veth0 - the virtual interface for one of the VMs, has IP 192.168.0.1 >> >> both eth0 and veth0 are added to the bridge, the networking setup is >> functional, however I seem to be unable to filter traffic to the VM with >> iptables > do you use /etc/network/interfaces to create the bridge interface? > > I've noticed in Debian that sysctl.conf is applied before the > if-up.d/bridge script has a chance to load the bridge module. as a > result, the sysctl for net.bridge remain the default. > i needed to add a post-up to my config to overcome this > > what is the current setting of net.bridge.bridge-nf-call-iptables? > > does re-applying sysctl.conf allow iptables to then pick up bridged > traffic (sysctl -p)? Thank you very much! This was indeed the problem! I have manually enabled net.bridge.bridge-nf-call-(ip(6)/arp)tables and that fixed the problem. I have now also added post-up entries to the bridge to do this on reboots. esac Regards, Marc -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
