Consider a machine with 3 NIC's. Two bridges are active; from eth1 to a vlan on eth0 and from eth3 to another vlan on eth0.
Interfaces:
auto lo
iface lo inet loopback
auto eth0
allow-hotplug eth0
iface eth0 inet manual
auto eth0.4
allow-hotplug eth0.4
iface eth0.4 inet manual
vlan-raw-device eth0
auto eth0.100
allow-hotplug eth0.100
iface eth0.100 inet manual
vlan-raw-device eth0
auto eth1
allow-hotplug eth1
iface eth1 inet manual
auto eth3
allow-hotplug eth3
iface eth3 inet manual
auto bri4
iface bri4 inet static
bridge_ports eth0.4 eth1
address 192.168.4.1
network 192.168.4.0
netmask 255.255.255.0
auto bri100
iface bri100 inet static
bridge_ports eth0.100 eth3
address 192.168.100.4
network 192.168.100.0
netmask 255.255.255.0
gateway 192.168.100.3
dns-nameservers 192.168.100.3
All this works 100%. I now wish to NAT all the traffic from the net on bri4 to the bri100. (Because that's where the gateways are).
I do this by:
iptables -t nat -A POSTROUTING -o bri100 -j MASQUERADE
This also works 100% for bri4 traffic, BUT NAT starts happening on the traffic that is bridging from eth3 to eth0.100 (ie the two bri100 components). This is of course completely unwanted and is causing mayhem with my VoIP servers. Clearly iptables is interpreting -o bri100 to ALSO include the bridged traffic within bri100 members.
How do i masquerade ONLY from bri4 to bri100 and not between the components of bri100? There is no -i option available in POSTROUTING.