bridge-nf-call-iptables: checking bridge vs. IP context?
Hi,
I'm wondering whether I'm currently overlooking a simple solution for the following:
When setting bridge-nf-call-iptables = 1, is there a simple way to check within one iptables rule whether it matched from a bridge netfilter hook or from an IP netfilter hook?
"--physdev-is-bridged" seemingly is not quite what I'm looking for, as it will only match after a bridging decision, in the FORWARD or POSTROUTING chains.
If that does not exist yet, what would be the preferred, upstreamable format: Adding a flag to "struct nf_bridge_info" or are there some other, already existing fields I could use to verify the context?
Regards, Linus
Quoted 6 lines · Linus Lüssing
I'm wondering whether I'm currently overlooking a simple solution for the following:
When setting bridge-nf-call-iptables = 1, is there a simple way to check within one iptables rule whether it matched from a bridge netfilter hook or from an IP netfilter hook?
What is the use case? I would try to not use nf-call-iptables if possible.
If its a bridge netfiler hook, its only visible in ebtables. If its a "native" IP netfilter hook, the skb has no bridge netfilter extension, --physdev-is-in/out will never match.
Quoted 3 lines
"--physdev-is-bridged" seemingly is not quite what I'm looking for, as it will only match after a bridging decision, in the FORWARD or POSTROUTING chains.
Yes, for some reason it was tied to output interface.
Quoted 9 lines · Florian Westphal
Quoted 6 lines · Linus Lüssing
I'm wondering whether I'm currently overlooking a simple solution for the following:
When setting bridge-nf-call-iptables = 1, is there a simple way to check within one iptables rule whether it matched from a bridge netfilter hook or from an IP netfilter hook?
What is the use case? I would try to not use nf-call-iptables if possible.
The use case is the following: I would like to use openNDS (captive portal) between bridge ports. As is it comes with a set of iptables rules. And I have the OpenWrt firewall with another set of iptables rules.
Ideally I would want to avoid major modifications to either of them.
For instance it would be great if I could avoid porting the iptables rules of openNDS to ebtables, to avoid the maintenance burden of keeping the iptables and ebtables version in sync. And actually conditionally, when bridge-nf-call-iptables is set, replacing any "-i" and "-o" on br-lan with --physdev-{in,out} on the bridge ports in openNDS already works quite well.
Now I'm wondering if it would be possible to conditionally, when bridge-nf-call-iptables is set, add something like a
"! --physdev-in-bridge-context" to all OpenWrt firewall rules. So that any rule in the OpenWrt firewall would behave as if I had bridge-nf-call-iptables=0. Again with the goal to avoid having to maintain a heavilly modified OpenWrt firewall rule set.
Quoted 5 lines
If its a bridge netfiler hook, its only visible in ebtables.
If its a "native" IP netfilter hook, the skb has no bridge netfilter extension, --physdev-is-in/out will never match.
Ah! Okay, so adding something like
"-m physdev ! --physdev-is-in" to all OpenWrt firewall rules should work?
So from a bridge netfilter hook "--physdev-in" will always either point to a bridge port or the bridge interface itself? And "--physdev-is-in" will always be true?
And in "native" IP netfilter hooks "--physdev-in" will never match and "--physdev-is-in" will always be false?
Quoted 2 lines · Linus Lüssing
Ah! Okay, so adding something like
"-m physdev ! --physdev-is-in" to all OpenWrt firewall rules should work?
Yes.
Quoted 3 lines
So from a bridge netfilter hook "--physdev-in" will always either point to a bridge port or the bridge interface itself? And "--physdev-is-in" will always be true?
--physdev-is-in is true when call-iptables infra is 1 and packet came in via a bridge port.
Quoted 1 line
And in "native" IP netfilter hooks "--physdev-in" will never match
It won't match if packet came in via a normal (not bridged) interface.
Quoted 1 line
and "--physdev-is-in" will always be false?
Yes.