Re: Problem with new --physdev-out style

[Volker Sauer <volker@volker-sauer.de>]

[-- Attachment #1: Type: text/plain, Size: 1611 bytes --]

On Mi, 24 Okt 2007, Patrick McHardy <kaber@trash.net> wrote:
> >This means, that all rules like that are valid even with the new concept
> >of netfilter, right?? But why do I get error messages like quoted in my
> >first mail for these rules - it *is* bridged traffic inside *one*
> >bridge!
> >And: I don't see how --physdev-is-bridged should help, since it's a
> >match and not a command to the kernel saying: "this *is* bridged
> >traffic". It the kernel does not see this by itself,
> >--physdev-is-bridged doesn't help.
> 
> Whether you believe it or not, this is the only way to tell
> the physdev match that the rule only affects purely bridged
> traffic.

Aah, now I get it! This way I can avoid the error message....
Great, I'll test it as soon as I'm back to the lab. 

> Does not work since one of the devices might be put in a different
> bridge after you loaded the rules.

Yes, you're right. 
Then the only solution is to improve the error messages.

> >If no, display a message like this:
> >
> >"physdev match: using --physdev-out in the FORWARD chains is only 
> >allowed if all physical interfaces are members of the same bridge."
> 
> 
> Feel free to send a patch to improve the error messages.

Oh, I'll see if I can patch kernel 2.6.23.1.

Regards
Volker

-- 
  Volker Sauer  *  Poststrasse 1/601   *   64293 Darmstadt  *   Germany
  E-Mail/Jabber: volker(at)volker-sauer.de * http://www.volker-sauer.de
  PGPKey-Fingerprint: DB26 11C7 B12E 0B27 3999 2E4F 7E35 4E4D 5DD5 D0E0
  http://wwwkeys.de.pgp.net/pks/lookup?op=get&search=0x7E354E4D5DD5D0E0 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]