Hello. Check sysctl variable bridge-nf-call-iptables. It should be equals 1, otherwise bridged traffic don't pass iptables. 2014-10-10 19:28 GMT+04:00 Aravindhan Dhanasekaran <adhanas@xxxxxxxx>: > Hello, > > I'm trying to mark UDP packets entering (or leaving) a bridge, destined to a > particular UDP port on a machine on the other side of the bridge. > > My simple topology looks like: > host1 [eth1] <-----> [s1-eth1] bridge [s1-eth2] <-----> [eth1] host2 > > > I've added a rule to the FORWARD chain on the mangle table in the bridge to mark > the packets that I require: > $ sudo iptables -t mangle -A FORWARD -p udp --dport 9917 -j MARK --set-mark 17 > $ iptables -L FORWARD -t mangle -v > Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) > pkts bytes target prot opt in out source destination > 0 0 MARK udp -- any any anywhere anywhere udp > dpt:9917 MARK set 0x11 > > > But, looks like none of packets are being marked (counters are all 0s in > iptables output as shown above). I have traffic matching the above rule flowing > through the bridge which I verified using tcpdump. > $ sudo tcpdump -i s1-eth1 udp dst port 9917 > ... > 11:22:14.774417 IP 10.0.0.2.49774 > 10.0.0.1.9917: UDP, length 1470 > 11:22:14.774597 IP 10.0.0.2.49774 > 10.0.0.1.9917: UDP, length 1470 > 11:22:14.774731 IP 10.0.0.2.49774 > 10.0.0.1.9917: UDP, length 1470^C > > 999 packets captured > 1831 packets received by filter > 795 packets dropped by kernel > > > I'm not sure what's wrong with my configuration. Any help would be appreciated. > > Thanks, > /Aravind > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- Anton. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
