Re: [PATCH v2 nf] netfilter: disable br_netfilter in user namespaces
Nikolay Aleksandrov <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
On 31/08/2026 17:49, Florian Westphal wrote: > Nikolay Aleksandrov <[email protected]> wrote: >> The patch looks good, thanks! >> 2 minor nits: >> BROPT_NF_CALL_IPTABLES is per bridge, not per port. Also please update the >> Netfilter section of Documentation/networking/bridge.rst that it won't work >> in non-init ns and is scheduled for removal. > > This sound good to you? > > The bridge netfilter module is a legacy feature that allows to filter bridged > -packets with iptables and ip6tables. Its use is discouraged. Users should > -consider using nftables for packet filtering. > +packets with iptables and ip6tables. This feature is scheduled for removal and > +not available in user namespaces. Consider using nftables for packet filtering > +instead. > > Thanks! Sounds good! Cheers, Nik