Re: [LARTC] iptables CLASSIFY and MARK not working?

From: Patrick McHardy <kaber@trash.net>
To: "Eliot, Wireless and Server Administrator,
	Great Lakes Internet" <support8@greatlakes.net>
Cc: lartc@mailman.ds9a.nl,
	Netfilter Development Mailinglist
	<netfilter-devel@lists.netfilter.org>
Subject: Re: [LARTC] iptables CLASSIFY and MARK not working?
Date: Thu, 01 Jun 2006 20:01:36 +0000	[thread overview]
Message-ID: <447F47A0.7000104@trash.net> (raw)
In-Reply-To: <0633E0EDB4F25F43A2D7179CA11FAFAB25541A@xavier.staff.greatlakes.net>

Eliot, Wireless and Server Administrator, Great Lakes Internet wrote:
> Bridged iptables (ebtables) is not enabled in the kernel and I cannot
> seem to find a variable "bridge-nf-call-iptables" to set with sysctl:
> 
> wireless-r1 linux # sysctl -w bridge-nf-call-iptables=0
> error: "bridge-nf-call-iptables" is an unknown key
> 
> There is also no /proc/sys/net/*/bridge anything. I assume that means
> this is not something I need to worry about?

Not sure yet, the problem would be created by CONFIG_BRIDGE_NETFILTER,
not ebtables itself. Check for
"/proc/sys/net/bridge/bridge-nf-call-iptables".

I'm actually pretty sure that this is indeed what's causing the problem,
bridge netfilter defers calling the IP POST_ROUTING hook until the
packet was already transmitted over the device (and before it goes
out the underlying device), which means when it hits the CLASSIFY
target it already passed through the qdisc.
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc