I'm currently setting up an Ubuntu 12.04 with 2 net interfaces. eth0 is on LAN_USERS ( intended for user and eth1 is on LAN_INFRA ( intended for management. Additionally, I've setup a bridge on eth1.

cat /etc/network/interfaces:

auto eth0
iface eth0 inet static

auto eth1
iface eth1 inet manual

auto br1
iface br1 inet static
  bridge_ports eth1
  bridge_stp on
  bridge_fd 0
  bridge_waitport 0
  1. As of Ubuntu 12.04, reverse path filtering is enabled (rp_filter=1)
  2. The output of # route -n is:
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    100    0        0 eth0   U     0      0        0 br1   U     0      0        0 eth0

Because of reverse path filtering, br1 isn't visible to networks other than I could disable reverse path filtering, but I decided to setup policy based routing.

Policy based Routing

  1. echo "250 infra >> /etc/iproute2/rt_tables
  2. ip rule add iif br1 table infra
  3. ip route add to default dev br1 table infra
  5. net.ipv4.ip_forward = 0
  6. net.ipv4.conf.eth1.rp_filter = 1
  7. net.ipv4.conf.br1.rp_filter = 1
  8. net.ipv4.conf.all.log_martians = 1

And it's not working....

How can i debug my PBR rules? Any obvious mistakes with my setup?


UPDATE: What I need is to route answers to packets coming from br1 back out via br1 again and not eth0. My simplest use case is: pings from to do not return cause of the default route and rp_filter=1. They are dropped as martian packets.

  • What kind of use case is pinging an interface you are not allowed to connect to anyway (management network)? Is this system going to be the router for these subnets? Are eth0 and eth1 connected to the same ethernet segment? You should describe (ASCII art) your network structure and the connections which shall be possible. – Hauke Laging Apr 29 '13 at 14:03
  • Bridges do not route packets, routers route packets; bridges bridge frames. Also, bridges do not send frames out the same interface where they entered the bridge. – Ron Maupin Mar 30 at 1:05

Your configuration says: "If a packet has arrived on br1 then send it via br1." That obviously doesn't make sense. Rules like that are for routers but you don't even mention routing.

What you mean is: "Send packets which are a reply to packets which have arrived on br1 via br1." This could be done with Netfilter's packet marks and the ip rule option fwmark. But here this would not make sense. Because you use rp_filter you can simply route by target address. You don't even need advanced routing (ip rule). For that. Plain normal routing should do the job: "Send via br1, the rest via eth0."

You have explained what you have done but have not mentioned any task that would require a complicated setup. If you "don't do anything" special what goes wrong then?

| improve this answer | |
  • My mistake. Updated my post. – Vassilis Apr 29 '13 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.