From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michele Petrazzo - Unipex srl Subject: Re: More ethernet port same ip address Date: Sat, 19 Jul 2008 18:05:00 +0200 Message-ID: <488210AC.9030102@unipex.it> References: <48819901.6030604@unipex.it> <4881F3A3.3080502@solutti.com.br> <488204EB.3090902@unipex.it> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Jan Engelhardt Cc: netfilter@vger.kernel.org, =?windows-1252?Q?Leonardo_Rodrigues_Ma?= =?windows-1252?Q?galh=E3es?= Jan Engelhardt wrote: >> Ok. Thanks for the simple, but complete explain. But where to say >> "go out through the right one?" > > The fact is, you do not know in advance which is the right one. So there is no solution with the "marking into PREROUTING" technique? Into my environ a packet that come from an interface MUST go out through that one. >>> And depending on the situation you might also need to enforce >>> routing at the bridge border so as to not open security holes. >> Have you some more words about this? Where can I found problems? >> How to modify routing? > > ebtables -t broute -P BROUTING DROP > > which will force all packets being routed. I'll try it soon. But in this case, why the kernel doesn't "lost" the package that ebtables wants to DROP? Or the kernel starts to see which is the first hole where the packet can go inside and leave it there? Seem a very contorted thinking to me... Thanks, MIchele