Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Running on Ubuntu. I have machine 1 < - > machine 2 < - > machine 3. I dont know machine 1 or machine 3 ip. It can be any ip. machine 1 send packet to machine 3 and machine 3 send packet to machine 1.

Machine 2 is used as a bridge:

ifconfig eth0
ifconfig eth2
brctl addbr br0
brctl addif br0 eth0 eth2
ifconfig br0 up

i want to have an iptable rule in machine 2 that will add all traffic that come to eth0 to nfqueue1 and all traffic that come to eth2 to nefqueue2.

Now i have the following rule:

iptables -A FORWARD -p tcp -j NFQUEUE --queue-num 0

which is not good to me because i want to distinguish between traffic that come from machine 3 to traffic that come from machine 1, so i want to have 2 rule.

Add -i eth0 to the rule doesn’t help.

share|improve this question
Can you just add a -s <source ip> specifier? – larsks Aug 12 '12 at 12:20
No . All trafic allowed but i need to distinguish between traffic from machine 1 to machine 3 – Avihai Marchiano Aug 12 '12 at 12:32
Right, and I'm suggesting that you use the source ip address to distinguish machine 1 from machine 3 (I'm not suggesting blocking traffic). You would need two rules in your FORWARD chain instead of 1... – larsks Aug 12 '12 at 12:54
The ip of the machines is not known its group of machines. – Avihai Marchiano Aug 12 '12 at 13:05
Ah, that wasn't clear. – larsks Aug 12 '12 at 13:06
up vote 1 down vote accepted

since you're operating a bridge, you need to use -m physdev

for usage, run iptables -m physdev -h - if you compile your own kernel, you may need to add this module.

share|improve this answer
10x i will test it tommorow. Why -i interfacename dosnt work ? – Avihai Marchiano Aug 12 '12 at 16:44
because the incoming interface is considered to be the bridge interface (br0), not the bridge port. – Olipro Aug 12 '12 at 20:18
iptables -A FORWARD -m physdev --physdev-in eth0 .... work!!!! great!!! – Avihai Marchiano Aug 13 '12 at 7:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.