mjhjmtu

TLDR: I setup a system for intercepting packets, and found that while using a network bridge, packets would disappear after the "mangle" table's PREROUTING chain, failing to hit rules in the "nat" table.

So I'll do my best to give my understanding of Linux packet flow, and the setup that is causing the issues. I can provide log output as needed, but this description should be sufficient to get the setup across.

First. my understanding of packet flow is based off this Linux Netfilter packet flow diagram.

In my setup, I have a standard network bridge that is transferring packets from one Ethernet interface to another (packet forwarding enabled in the system, obviously), this part works as expected. However, I need to NAT certain packets, so I've applied the ebtables "redirect to DROP" trick to cause certain packets to be parsed by iptables, even when the packet is destined for a completely different system. I've confirmed that these packets will get parsed successfully by the PREROUTING chains in both the "raw" and "mangle" tables (confirmed via the LOG target), but the "nat" table's PREROUTING chain will never see the packet. I see no errors in syslog, I have no indication of where this packet is going, or why the "nat" table can never see it.

Based on what I know, the route the packet takes should be straightforward, where the flow should be broute:BROUTING->raw:PREROUTING->conntrack->mangle:PREROUTING->nat:PREROUTING. Everything but that last step works as expected, and I've so far been unable to even begin to debug why "nat:PREROUTING" rules do not even see any of the redirected packets.

Is my understanding of netfilter packet flow off, or is there some caveat about network bridges and iptables interaction that I am missing?

Thank you!