Re: RFC: Disable defered bridge hooks by default

[Patrick McHardy <kaber@trash.net>]

Tom Eastep wrote:
> On Wed, 2006-07-19 at 16:21 +0200, Patrick McHardy wrote:
> 
>>It there anything preventing your users from you routing outgoing
>>packets to the bridge ports directly? I assume if they use IP/port
>>filters they should already have a pretty good idea of whats located
>>behind a bridge port and don't really need the bridge to route the
>>packets.
>>
> 
> 
> It is possible to define a Shorewall zone as a set of (interface,
> network) pairs (where 'network' may be a single host) rather than a set
> of (bridge, port) pairs. So instead of defining a bridged zone as 'all
> hosts whose traffic goes in/out port P on bridge B', the user can define
> the same zone as (B,net1),(B,net2),... where net1,net2,... defines the
> same set of hosts (extra care must be taken when a default route goes
> through a bridge port)
> 
> While this alternative definition is more cumbersome and error-prone for
> the user to configure and maintain, it removes the need for filtering by
> bridge port entirely. That approach is probably what I will recommend to
> current users when --physdev-out is no longer available.

That should work if the location of the hosts is already known. But in
that case I still wonder why route to the bridge at all .. the ports
should work as well as long as you know where the individual hosts are
located.

Anyway, glad you found a viable alternative for shorewall.