"Performing cross-bridge DNAT requires IP forwarding to be enabled"

Hi there,

Please also Cc:-me in replies, since I haven't yet received confirmation that
I successfully joined the list.

I'm getting the message "Performing cross-bridge DNAT requires IP forwarding to
be enabled" when doing DNAT. I have checked the FAQ and its suggestions,
but I can't seem to figure it out. IP forwarding is on, and there are
routes defined to both source and destination.

The interfaces on my system:

eth0	- part of bridge eth3
eth1	- 80.126.179.10, to the Internet
eth2	- part of bridge eth3
ppp0	- 192.168.127.14, VPN to my work
lo	- loopback
eth3	- bridge, has address 192.168.1.1/24

The routing table:

192.168.127.1 dev ppp0  proto kernel  scope link  src 192.168.127.14
192.168.1.0/24 dev eth3  proto kernel  scope link  src 192.168.1.1
10.1.0.0/16 dev eth1  scope link
172.0.0.0/8 via 192.168.127.1 dev ppp0
127.0.0.0/8 dev lo  scope link
default via 10.1.0.138 dev eth1  metric 1

On 127.0.0.1 port 80 I have a webserver. 192.168.1.244 is a client
connected via port eth2 of bridge eth3. My goal: TCP traffic with 
destination port 80 coming in via bridgeport eth2 must be diverted
to the webserver running on 127.0.0.1:80.

I have made the following iptables rule:

iptables -t nat -A PREROUTING -m physdev --physdev-in eth2 -p tcp 
--dport 80 -j DNAT --to-destination 127.0.0.1

On 192.168.1.244, connections to any remote TCP port 80 now time out,
and on the Linux box the error "Performing cross-bridge DNAT requires IP
forwarding to be enabled" show up in syslog.

From the Linux-box I can ping 127.0.0.1, 192.168.1.244 and 192.168.1.1.
From 192.168.1.244, I can ping 192.168.1.1, the outside world (SNAT
via eth1), and machines at work (SNAT via ppp0).

I have linux-2.6.8.1 and iptables 1.2.11.

Thanks,
-- 
Jurjen Oskam
"I often reflect that if "privileges" had been called "responsibilities" or
"duties", I would have saved thousands of hours explaining to people why
they were only gonna get them over my dead body." - Lee K. Gleason, VMS sysadmin


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl