Re: Problem with new --physdev-out style

[Patrick McHardy <kaber@trash.net>]

Philip Craig wrote:
> Patrick McHardy wrote:
>> Philip Craig wrote:
>>> Patrick McHardy wrote:
>>>>> $IPTABLES -A FORWARD -i $BR_GUEST -o $BR_INT -m physdev --physdev-out $IF_DMZ -p tcp --dport 3389 -j ACCEPT
>>>> Try adding "--physdev-is-bridged" to your rules. Without that the kernel
>>>> is not able to tell whether they apply only to bridged packets or also
>>>> to forwarded or locally generated ones.
>>> That won't work for the above rule, for example, since the packet is
>>> being forwarded between two different bridges, so it is not bridged.
>>
>> I see nothing indicating that it is being forwarded.
> 
> They are different bridges, BR_GUEST and BR_INT, doesn't that mean it must
> be forwarded?


You're right.