Re: [PATCH -next] netfilter: bridge: optionally set indev to vlan

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Apr 05, 2012 at 09:30:59AM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Wed, Apr 04, 2012 at 09:57:29PM +0200, Florian Westphal wrote:
> > > if net.bridge.bridge-nf-filter-vlan-tagged sysctl is enabled, bridge
> > > netfilter removes the vlan header temporarily and then feeds the packet
> > > to ip(6)tables.
> > > 
> > > When the new "bridge-nf-pass-vlan-input-device" sysctl is on
> > > (default off), then bridge netfilter will also change the in/out
> > > interface to the vlan interface; if such an interface exists.
> > > 
> > > This is needed to make iptables REDIRECT target work with
> > > "vlan-on-top-of-bridge" setups. Also, 'iptables -i' can then be used
> > > to match the vlan device name.
> > > 
> > > Also update Documentation with current brnf default settings.
> > 
> > Better to implement a vlan device match for iptables?
> 
> That would mean that REDIRECT target is unsupported in vlan-on-bridge
> case.

I see, it would not support any other targets that relies on skb->dev
either.

Let me think if I can come with a better solution. If not, I'll take
your patch.

Thanks Florian.