Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on bridge on linux box using brctl. Now I have to scan and monitor bridge traffic through iptables.

So for the same I changed:

net.bridge.bridge-nf-call-iptables = 0 to net.bridge.bridge-nf-call-iptables = 1 in /etc/sysctl.conf

And add below rules into iptables:

/sbin/iptables -A INPUT -m physdev --physdev-in eth2 -p tcp -m tcp --dport 3127 -m state --state NEW -j ACCEPT

/sbin/iptables -t nat -I PREROUTING -m physdev --physdev-in eth2 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3127

to acheive traffic coming in eth2 and port 80 should be redirect to 3127 on my linux box.

And it is working fine for normal (untagged) traffic.

So I have to do the same for tagged traffic, but it is not working.

I changed:

net.bridge.bridge-nf-filter-vlan-tagged = 0 to net.bridge.bridge-nf-filter-vlan-tagged = 1 in /etc/sysctl.conf

Help me for tagged traffic.


share|improve this question

if your traffic is tagged, then your network I faces will be called eth1.X and/or eth2.Y. did you set new iptable rules accordingly?

share|improve this answer
I don't have VLAN configured on any bridge interface. I made a bridge on say eth2 and eth3, hosts under eth2 are under managed switch so tagged traffic is coming in through eth2 and I mentioned rule according to physical device. – Hitesh Menghani Feb 6 '14 at 7:30
Don't expect you'r eiptable rules to match if the kernelk is not aware it is dealing with a tagged 802.1q packet. It will fail to match port and hosst information because of the offset introduced by tagging. You have to let the kernel how you have tagged packets if you want it to manipulate those packets. take a look at ebtables and tagging, but you'll have to set vlan iface at some point if you want the kernel to play with tagged packets. See (Do {ip,ip6,arp}tables see VLAN tagged IPv4/IPv6/ARP traffic on an untagged bridge? ) – alxgomz Feb 6 '14 at 7:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.