Re: Problem with new --physdev-out style

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Patrick McHardy a écrit :
> Philip Craig wrote:
> 
>> Patrick McHardy wrote:
>>
>>>> $IPTABLES -A FORWARD -i $BR_GUEST -o $BR_INT -m physdev 
>>>> --physdev-out $IF_DMZ -p tcp --dport 3389 -j ACCEPT
>>>
>>> Try adding "--physdev-is-bridged" to your rules. Without that the kernel
>>> is not able to tell whether they apply only to bridged packets or also
>>> to forwarded or locally generated ones.
>>
>> That won't work for the above rule, for example, since the packet is
>> being forwarded between two different bridges, so it is not bridged.

Do you mean that the "bridged" flag (or whatever way this is 
implemented) is not reset when the packet is routed ? Doesn't this sound 
like a bug ?

> I see nothing indicating that it is being forwarded

"-A FORWARD -i $BR_GUEST -o $BR_INT"