From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pascal Hambourg Subject: Re: NAT for multiple non-directly connected subnets Date: Sat, 10 Nov 2007 00:08:17 +0100 Message-ID: <4734E861.3030106@plouf.fr.eu.org> References: <1194559495.19115.105.camel@grateful.d.umn.edu> <1194560755.19115.110.camel@grateful.d.umn.edu> Mime-Version: 1.0 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-Id: Content-Type: text/plain; charset="iso-8859-1"; format="flowed" To: Bradley Kite Cc: netfilter@vger.kernel.org Hello, Bradley Kite a =E9crit : >=20 > the connection-tracking needs to be turned off on the bridges in orde= r > to make this work: >=20 > iptables --table raw -A PREROUTING -i [BRIDGE] -j NOTRACK This may have undesirable side effects unless you add "-m physdev=20 --physdev-is-bridged" to ensure that this rule matches only bridged=20 traffic and not forwarded traffic received on the bridge interface. If you just don't want Netfilter (including the conntrack and iptables)= =20 to see the bridged IP traffic, you can do this by setting the sysctl=20 net.bridge.bridge-nf-call-iptables to 0. echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables or sysctl -w net.bridge.bridge-nf-call-iptables=3D0 Add the following line in /etc/sysctl.conf to make it persistent across= =20 reboots : net.bridge.bridge-nf-call-iptables=3D0 --=20