Re: Veth problems with bridge

[Patrick McHardy <kaber@trash.net>]

Bernhard Miklautz wrote:
> Hi Patrick,
> 
> Patrick McHardy wrote:
>> Bernhard Miklautz wrote:
>>> [...]
>>> I also tried the whole setup without using veth; the IP directly bound
>>> to br0, as well as without the bridge at all. No problems with that.
>>> So there might be some problems with veth?
>> Does "echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables" fix it?
> 
> On my hardware machine this seems to fix the problem :). But why does
> bridge-nf-call-iptables influent source nat on an other interface? -
> Shouldn't the source address always be translated when an output
> interface is set (iptables -A POSTROUTING -o eth3 -t nat -j MASQUERADE)?


The bridging code passes packets through IPv4 netfilter and
connection tracking, so when they hit your MASQUERADE rule,
the NAT mappings have already been set up.

Its a really bad default, but I feel uneasy changing it since
I'm sure some people are relying on it.