Bridge and iptables postrouting

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP












2















I have a Linux 3.14 PC with three NICs and a bridge between two of the NICs (eth1 and eth2).



My Question



Why is there no traffic passing through the POSTROUTING rule? FYI, traffic is passing through (forwarded) the bridge just fine. Can someone be kind enough to provide me some pointers to get this working?



ifconfig eth1 down
ifconfig eth2 down

ifconfig eth1 up
ifconfig eth1 0.0.0.0

ifconfig eth2 up
ifconfig eth2 0.0.0.0

brctl addbr sm0
brctl addif sm0 eth1
brctl addif sm0 eth2

ifconfig sm0 up

iptables -t mangle -A POSTROUTING -o eth1 -p all -j CLASSIFY --set-class 1:99

iptables -t mangle -A POSTROUTING -o eth2 -p all -j CLASSIFY --set-class 2:99


Rules



o iptables -t mangle -nvL
Chain PREROUTING (policy ACCEPT 38914 packets, 2954K bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy ACCEPT 38210 packets, 2791K bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 38072 packets, 2844K bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 38072 packets, 2844K bytes)
pkts bytes target prot opt in out source destination
0 0 CLASSIFY all -- * eth1 0.0.0.0/0 0.0.0.0/0 CLASSIFY set 1:99
0 0 CLASSIFY all -- * eth2 0.0.0.0/0 0.0.0.0/0 CLASSIFY set 2:99


sysctl.conf



net.ipv4.ip_forward=1


Setting the values below to 0 or 1 has no effect on the iptables



net.bridge.bridge-nf-call-arptables=1
net.bridge.bridge-nf-call-ipv6tables=1
net.bridge.bridge-nf-call-ipv4tables=1









share|improve this question




























    2















    I have a Linux 3.14 PC with three NICs and a bridge between two of the NICs (eth1 and eth2).



    My Question



    Why is there no traffic passing through the POSTROUTING rule? FYI, traffic is passing through (forwarded) the bridge just fine. Can someone be kind enough to provide me some pointers to get this working?



    ifconfig eth1 down
    ifconfig eth2 down

    ifconfig eth1 up
    ifconfig eth1 0.0.0.0

    ifconfig eth2 up
    ifconfig eth2 0.0.0.0

    brctl addbr sm0
    brctl addif sm0 eth1
    brctl addif sm0 eth2

    ifconfig sm0 up

    iptables -t mangle -A POSTROUTING -o eth1 -p all -j CLASSIFY --set-class 1:99

    iptables -t mangle -A POSTROUTING -o eth2 -p all -j CLASSIFY --set-class 2:99


    Rules



    o iptables -t mangle -nvL
    Chain PREROUTING (policy ACCEPT 38914 packets, 2954K bytes)
    pkts bytes target prot opt in out source destination

    Chain INPUT (policy ACCEPT 38210 packets, 2791K bytes)
    pkts bytes target prot opt in out source destination

    Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts bytes target prot opt in out source destination

    Chain OUTPUT (policy ACCEPT 38072 packets, 2844K bytes)
    pkts bytes target prot opt in out source destination

    Chain POSTROUTING (policy ACCEPT 38072 packets, 2844K bytes)
    pkts bytes target prot opt in out source destination
    0 0 CLASSIFY all -- * eth1 0.0.0.0/0 0.0.0.0/0 CLASSIFY set 1:99
    0 0 CLASSIFY all -- * eth2 0.0.0.0/0 0.0.0.0/0 CLASSIFY set 2:99


    sysctl.conf



    net.ipv4.ip_forward=1


    Setting the values below to 0 or 1 has no effect on the iptables



    net.bridge.bridge-nf-call-arptables=1
    net.bridge.bridge-nf-call-ipv6tables=1
    net.bridge.bridge-nf-call-ipv4tables=1









    share|improve this question


























      2












      2








      2


      2






      I have a Linux 3.14 PC with three NICs and a bridge between two of the NICs (eth1 and eth2).



      My Question



      Why is there no traffic passing through the POSTROUTING rule? FYI, traffic is passing through (forwarded) the bridge just fine. Can someone be kind enough to provide me some pointers to get this working?



      ifconfig eth1 down
      ifconfig eth2 down

      ifconfig eth1 up
      ifconfig eth1 0.0.0.0

      ifconfig eth2 up
      ifconfig eth2 0.0.0.0

      brctl addbr sm0
      brctl addif sm0 eth1
      brctl addif sm0 eth2

      ifconfig sm0 up

      iptables -t mangle -A POSTROUTING -o eth1 -p all -j CLASSIFY --set-class 1:99

      iptables -t mangle -A POSTROUTING -o eth2 -p all -j CLASSIFY --set-class 2:99


      Rules



      o iptables -t mangle -nvL
      Chain PREROUTING (policy ACCEPT 38914 packets, 2954K bytes)
      pkts bytes target prot opt in out source destination

      Chain INPUT (policy ACCEPT 38210 packets, 2791K bytes)
      pkts bytes target prot opt in out source destination

      Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
      pkts bytes target prot opt in out source destination

      Chain OUTPUT (policy ACCEPT 38072 packets, 2844K bytes)
      pkts bytes target prot opt in out source destination

      Chain POSTROUTING (policy ACCEPT 38072 packets, 2844K bytes)
      pkts bytes target prot opt in out source destination
      0 0 CLASSIFY all -- * eth1 0.0.0.0/0 0.0.0.0/0 CLASSIFY set 1:99
      0 0 CLASSIFY all -- * eth2 0.0.0.0/0 0.0.0.0/0 CLASSIFY set 2:99


      sysctl.conf



      net.ipv4.ip_forward=1


      Setting the values below to 0 or 1 has no effect on the iptables



      net.bridge.bridge-nf-call-arptables=1
      net.bridge.bridge-nf-call-ipv6tables=1
      net.bridge.bridge-nf-call-ipv4tables=1









      share|improve this question
















      I have a Linux 3.14 PC with three NICs and a bridge between two of the NICs (eth1 and eth2).



      My Question



      Why is there no traffic passing through the POSTROUTING rule? FYI, traffic is passing through (forwarded) the bridge just fine. Can someone be kind enough to provide me some pointers to get this working?



      ifconfig eth1 down
      ifconfig eth2 down

      ifconfig eth1 up
      ifconfig eth1 0.0.0.0

      ifconfig eth2 up
      ifconfig eth2 0.0.0.0

      brctl addbr sm0
      brctl addif sm0 eth1
      brctl addif sm0 eth2

      ifconfig sm0 up

      iptables -t mangle -A POSTROUTING -o eth1 -p all -j CLASSIFY --set-class 1:99

      iptables -t mangle -A POSTROUTING -o eth2 -p all -j CLASSIFY --set-class 2:99


      Rules



      o iptables -t mangle -nvL
      Chain PREROUTING (policy ACCEPT 38914 packets, 2954K bytes)
      pkts bytes target prot opt in out source destination

      Chain INPUT (policy ACCEPT 38210 packets, 2791K bytes)
      pkts bytes target prot opt in out source destination

      Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
      pkts bytes target prot opt in out source destination

      Chain OUTPUT (policy ACCEPT 38072 packets, 2844K bytes)
      pkts bytes target prot opt in out source destination

      Chain POSTROUTING (policy ACCEPT 38072 packets, 2844K bytes)
      pkts bytes target prot opt in out source destination
      0 0 CLASSIFY all -- * eth1 0.0.0.0/0 0.0.0.0/0 CLASSIFY set 1:99
      0 0 CLASSIFY all -- * eth2 0.0.0.0/0 0.0.0.0/0 CLASSIFY set 2:99


      sysctl.conf



      net.ipv4.ip_forward=1


      Setting the values below to 0 or 1 has no effect on the iptables



      net.bridge.bridge-nf-call-arptables=1
      net.bridge.bridge-nf-call-ipv6tables=1
      net.bridge.bridge-nf-call-ipv4tables=1






      networking iptables bridge






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Jul 2 '15 at 14:37









      G-Man

      13.6k93770




      13.6k93770










      asked Jul 2 '15 at 13:58









      AlbertKAlbertK

      161




      161




















          1 Answer
          1






          active

          oldest

          votes


















          1














          Your bridge isn't routing traffic, so there's nothing to go through the POSTROUTING rule.



          See the netfilter documentation for bridge-netfilter for details and a method to change this configuration (kernel 3.2.0):



          modprobe bridge # Enable bridge-netfilter
          echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables





          share|improve this answer























          • I have the above statement in the system but still no traffic going through the postrouting rule. I am sure that traffic is flowing through the bridge as I am accessing and posting this from the machine attached to the eth2 NIC (LAN facing) of the bridge.

            – AlbertK
            Jul 3 '15 at 11:01












          • I'm sure you're correct that traffic is flowing through the bridge. What I said was that the bridge isn't routing traffic.

            – roaima
            Mar 3 at 9:10











          Your Answer








          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "106"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: false,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: null,
          bindNavPrevention: true,
          postfix: "",
          imageUploader:
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          ,
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













          draft saved

          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f213542%2fbridge-and-iptables-postrouting%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown

























          1 Answer
          1






          active

          oldest

          votes








          1 Answer
          1






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes









          1














          Your bridge isn't routing traffic, so there's nothing to go through the POSTROUTING rule.



          See the netfilter documentation for bridge-netfilter for details and a method to change this configuration (kernel 3.2.0):



          modprobe bridge # Enable bridge-netfilter
          echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables





          share|improve this answer























          • I have the above statement in the system but still no traffic going through the postrouting rule. I am sure that traffic is flowing through the bridge as I am accessing and posting this from the machine attached to the eth2 NIC (LAN facing) of the bridge.

            – AlbertK
            Jul 3 '15 at 11:01












          • I'm sure you're correct that traffic is flowing through the bridge. What I said was that the bridge isn't routing traffic.

            – roaima
            Mar 3 at 9:10















          1














          Your bridge isn't routing traffic, so there's nothing to go through the POSTROUTING rule.



          See the netfilter documentation for bridge-netfilter for details and a method to change this configuration (kernel 3.2.0):



          modprobe bridge # Enable bridge-netfilter
          echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables





          share|improve this answer























          • I have the above statement in the system but still no traffic going through the postrouting rule. I am sure that traffic is flowing through the bridge as I am accessing and posting this from the machine attached to the eth2 NIC (LAN facing) of the bridge.

            – AlbertK
            Jul 3 '15 at 11:01












          • I'm sure you're correct that traffic is flowing through the bridge. What I said was that the bridge isn't routing traffic.

            – roaima
            Mar 3 at 9:10













          1












          1








          1







          Your bridge isn't routing traffic, so there's nothing to go through the POSTROUTING rule.



          See the netfilter documentation for bridge-netfilter for details and a method to change this configuration (kernel 3.2.0):



          modprobe bridge # Enable bridge-netfilter
          echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables





          share|improve this answer













          Your bridge isn't routing traffic, so there's nothing to go through the POSTROUTING rule.



          See the netfilter documentation for bridge-netfilter for details and a method to change this configuration (kernel 3.2.0):



          modprobe bridge # Enable bridge-netfilter
          echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables






          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered Jul 2 '15 at 17:01









          roaimaroaima

          45.9k758124




          45.9k758124












          • I have the above statement in the system but still no traffic going through the postrouting rule. I am sure that traffic is flowing through the bridge as I am accessing and posting this from the machine attached to the eth2 NIC (LAN facing) of the bridge.

            – AlbertK
            Jul 3 '15 at 11:01












          • I'm sure you're correct that traffic is flowing through the bridge. What I said was that the bridge isn't routing traffic.

            – roaima
            Mar 3 at 9:10

















          • I have the above statement in the system but still no traffic going through the postrouting rule. I am sure that traffic is flowing through the bridge as I am accessing and posting this from the machine attached to the eth2 NIC (LAN facing) of the bridge.

            – AlbertK
            Jul 3 '15 at 11:01












          • I'm sure you're correct that traffic is flowing through the bridge. What I said was that the bridge isn't routing traffic.

            – roaima
            Mar 3 at 9:10
















          I have the above statement in the system but still no traffic going through the postrouting rule. I am sure that traffic is flowing through the bridge as I am accessing and posting this from the machine attached to the eth2 NIC (LAN facing) of the bridge.

          – AlbertK
          Jul 3 '15 at 11:01






          I have the above statement in the system but still no traffic going through the postrouting rule. I am sure that traffic is flowing through the bridge as I am accessing and posting this from the machine attached to the eth2 NIC (LAN facing) of the bridge.

          – AlbertK
          Jul 3 '15 at 11:01














          I'm sure you're correct that traffic is flowing through the bridge. What I said was that the bridge isn't routing traffic.

          – roaima
          Mar 3 at 9:10





          I'm sure you're correct that traffic is flowing through the bridge. What I said was that the bridge isn't routing traffic.

          – roaima
          Mar 3 at 9:10

















          draft saved

          draft discarded
















































          Thanks for contributing an answer to Unix & Linux Stack Exchange!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid


          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.

          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f213542%2fbridge-and-iptables-postrouting%23new-answer', 'question_page');

          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown






          Popular posts from this blog

          How to check contact read email or not when send email to Individual?

          Displaying single band from multi-band raster using QGIS

          How many registers does an x86_64 CPU actually have?