DNAT and 802.1q tagged bridge

DNAT and 802.1q tagged bridge

[Yavetskiy Yuriy]

I have a bridge of two physical interfaces: eth1, eth2. Vlan tagged 
packets go through this bridge, but bridge itself doesn't know about 
vlan numbers (there're a lot of vlans,they change frequently, it's 
impossible to set them on a bridge) and bridge has no ip address.
ebtables and conntrack are  both loaded.
DROP and ACCEPT run on this bridge.
Under certain destination ip and port, I need to DNAT packets to 
loopback, I add 10.0.0.1 to loopback, as DNAT often doesn't work on 127/8.
Here's an example rule which somehow does not work:
iptables-t nat-A PREROUTING-m physdev - physdev-in eth1-d 1.1.1.1-j DNAT 
- to-destination 10.0.0.1
iptables-t nat-A POSTROUTING-s 10.0.0.1-j SNAT - to-source 1.1.1.1
Packages come on eth1. Return (after Snat) packets must go through eth0, 
the interface is untagged, the gateway lives behind it.
I make a telnet from the world, in iptables DNaT counter is incremented 
by 1, but telnet does not respond, syn + ack in response does not come, 
and counters of SNAT are zeroed. Telnet passes from bridge machine, the 
problem is exactly in DNAT. This scheme also doesn't work without SNAT.
Maybe the problem is that packets Tagged? But netfilter is not looking 
at the package ethernet headers during DNaT, it looks only on IP packet 
headers, as DNaT, for example, can be done in Gre-tunnel, which is not 
ethernet device. Maybe reason in no ipv4 routes on bridge interface (but 
interface is tagged, I don't know vlan numbers and there are no untagged 
packets running throu bridge so I can't simply add route on bridge device).


-- 
WBR
Yavetskiy Yuriy
ULTI-RIPE