Re: VLAN interface on top of the bridge interface

Op wo, 19-04-2006 te 07:19 +0200, schreef Martin Rusko:
> Hi,
> 
> please find bellow also my original post regarding subject. Is this 
> expected behavior?
> 
> When vlan interfaces are created on top of the real NIC (so not over
> bridged interface), it works. So I would say, that it really looks like
> bridge is discarding anything bigger than 1500. But this is happening
> only when /proc/sys/net/bridge/bridge-nf-call-iptables = 0. If this is
> set to 1, it works.

Packets bigger than the MTU of your network (1500) cannot be sent over
your network without being fragmented. A bridge doesn't know how to
fragment packets, so your packets will be dropped. The reason why it
works with iptables is because connection tracking will fragment the
(IP) packet for you.

> Problem here is, that I really do not want to see bridged traffic in
> iptables, because it is causing troubles on another place. :-)

I don't see why you can't come up with a solution. The physdev match can
tell you whether the packet is bridged or not, so just don't let your
iptables rules see the bridged packets by accepting them as your first
rule.

cheers,
Bart




-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642