Re: Marking frames with ebtables for iptables

[Pascal Hambourg <pascal@plouf.fr.eu.org>]

Hello,

Oliver Graute a écrit :
> 
> I try to mark some frames with ebtables on MAC Layer to pass these mark to 
> iptables network layer.
> 
> I build up a bridge interface br0, cleared all ebtables and iptables tables 
> as preparation. Then I try something like this:   
> 
> ebtables -t filter -A INPUT -p IPv4 -s 00:11:22:33:44:55 -i eth0 -j mark --
> mark-set 0xffff --mark-target ACCEPT
> ebtables -t filter -A INPUT --log-level info --log-ip --log-prefix EBFW
> iptables -t mangle -A PREROUTING -m mark --mark 0xffff

What's the use of this rule with no target ?

> iptables -t mangle -A PREROUTING -m mark --mark 0xffff -j LOG --log-level 
> info --log-prefix MARKED
> 
> i would expect that iptables log show me the marked packages from ebtables. 
> But i see no mark 0xffff

Check the packet flow diagram at
<https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg>

You can see that if the packet is received on a bridge (blue
background), ebtables/INPUT (blue header) comes after
iptables/PREROUTING (green header). To avoid the iptables/ebtables mix,
you must disable iptables call by bridge-nf :

echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables

What is your goal ? If you just need to match the source MAC address,
you don't need ebtables. Iptables has the "mac" match.