Re: Bridge netfilter defered hooks

[Patrick McHardy <kaber@trash.net>]

Carl-Daniel Hailfinger wrote:
> Patrick McHardy wrote:
> 
>>Thats what I meant by "iptables+mark". You can combine iptables
>>specific matches by marking matching packets, then match on the
>>mark with ebtables (or the other way around for incoming packets).
> 
> 
> IIRC the mark has only 32 bits. Not so long ago, I was using 30 bits
> of that in my firewalling rules on a bridge-router. I might have
> squeezed the physdev match in the remaining 2 bits, but I'm not
> sure. I do admit the setup was fairly uncommon (bridging and
> double nat with only one machine).

Yes, its getting a bit tight in there, but so far in all setups I've
seen it was possible to get along with the 32 bits using masks or
reusing bits after they are no longer needed. I guess we'll have to
wait and see ..