1

Consider a machine with 3 NIC's. Two bridges are active; from eth1 to a vlan on eth0 and from eth3 to another vlan on eth0.

Interfaces:

auto lo
iface lo inet loopback

auto eth0
allow-hotplug eth0
iface eth0 inet manual

auto eth0.4
allow-hotplug eth0.4
iface eth0.4 inet manual
     vlan-raw-device eth0

auto eth0.100
allow-hotplug eth0.100
iface eth0.100 inet manual
     vlan-raw-device eth0

auto eth1
allow-hotplug eth1
iface eth1 inet manual

auto eth3
allow-hotplug eth3
iface eth3 inet manual

auto bri4
iface bri4 inet static
     bridge_ports eth0.4 eth1
     address 192.168.4.1
     network 192.168.4.0
     netmask 255.255.255.0

auto bri100
iface bri100 inet static
     bridge_ports eth0.100 eth3
     address 192.168.100.4
     network 192.168.100.0
     netmask 255.255.255.0
     gateway 192.168.100.3
     dns-nameservers 192.168.100.3

All this works 100%. I now wish to NAT all the traffic from the net on bri4 to the bri100. (Because that's where the gateways are).

I do this by:

iptables -t nat -A POSTROUTING -o bri100 -j MASQUERADE

This also works 100% for bri4 traffic, BUT NAT starts happening on the traffic that is bridging from eth3 to eth0.100 (ie the two bri100 components). This is of course completely unwanted and is causing mayhem with my VoIP servers. Clearly iptables is interpreting -o bri100 to ALSO include the bridged traffic within bri100 members.

How do i masquerade ONLY from bri4 to bri100 and not between the components of bri100? There is no -i option available in POSTROUTING.

Improve this question
2
  • 2
    The simple solution is don't NAT. Remember that NAT is something you should be avoiding whenever possible. If it's necessary at all, it should be done only at the edge(s) of your network.
    – Michael Hampton
    Jan 7, 2016 at 7:50
  • Appreciated and agreed, but i really have to. Even simpler solution would be to bridge with a managed VLAN switch or so outside of the linux box, but i really need this resolved for other complex reasons/vlans/applications on this box. The listed config is only a very small part of the actual interfaces.
    – Michael Atkinson
    Jan 7, 2016 at 9:15

2 Answers 2

Reset to default
2

In POSTROUTING you can use -s to match on the range of IP addresses you use internally or externally in order to decide whether to perform SNAT/MASQUERADE. This is useful if your LAN has a mixture of hosts with public IP addresses and hosts with only private addresses.

In your specific case it doesn't make a lot of sense though as it seems both ranges are private. If the traffic is leaving your network, then NAT is needed for both ranges. If it does not leave your network, then NAT is not needed.

Improve this answer
1
  • That works perfectly. Solution provided and thanks very many!
    – Michael Atkinson
    Jan 7, 2016 at 13:29
0

By default linux passes bridge traffic through iptables (or ip6tables for ipv6 traffic). There are valid usecases for this but a lot of the time it's more of a PITA than a help.

You can disable this feature through sysctls

sysctl -w net.bridge.bridge-nf-call-iptables=0 sysctl -w net.bridge.bridge-nf-call-ip6tables=0

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .