--in-interface and --out-interface issue on bridge

--in-interface and --out-interface issue on bridge

[Wang Jian]

Hi,

During my test, I find that --in-interface doesn't work as I expected.

  web server -- (eth0--br0--eth1)  -- web client


# iptables -t mangle -A PREROUTING -i eth0 -p tcp --sport 80 \
	-j MARK --set-mark 1

doesn't set mark to 1.

I google a while and read some pages that use such a rule for bridged
firewall.

# iptables -A FORWARD --in-interface eth0 --out-interface eth1 \
	-j ACCEPT

I test this rule and fail

# iptables -t mangle -A FORWARD -i eth0 -p tcp --sport 80 \
	-j MARK --set-mark 1

If I removed -i eth0 or use -i br0 instead, then the mark is set.

I looked into net/core/dev.c and net/bridge/* and didn't get clue about
this.

kernel is vanilla 2.6.11 with bridge packet filtering on.


-- 
  lark

Re: --in-interface and --out-interface issue on bridge

[Patrick McHardy]

Wang Jian wrote:
> Hi,
> 
> During my test, I find that --in-interface doesn't work as I expected.
> 
>   web server -- (eth0--br0--eth1)  -- web client
> 
> 
> # iptables -t mangle -A PREROUTING -i eth0 -p tcp --sport 80 \
> 	-j MARK --set-mark 1
> 
> doesn't set mark to 1.

Find out which interface is used using LOG. There is a physdev-match
for use with briding, perhaps this is what you need.

Regards
Patrick

Re: --in-interface and --out-interface issue on bridge

[Wang Jian]

Hi Patrick McHardy,

Thanks a lot for your hint.

Just in curiousness: when and why the -i and -o don't match on bridge's
physic device? A lot of documents on bridging firewall give example
using -i and -o.

On Sun, 24 Apr 2005 18:28:17 +0200, Patrick McHardy <kaber@trash.net> wrote:

> Wang Jian wrote:
> > Hi,
> > 
> > During my test, I find that --in-interface doesn't work as I expected.
> > 
> >   web server -- (eth0--br0--eth1)  -- web client
> > 
> > 
> > # iptables -t mangle -A PREROUTING -i eth0 -p tcp --sport 80 \
> > 	-j MARK --set-mark 1
> > 
> > doesn't set mark to 1.
> 
> Find out which interface is used using LOG. There is a physdev-match
> for use with briding, perhaps this is what you need.
> 
> Regards
> Patrick



-- 
  lark