Re: VLAN interface on top of the bridge interface

Hi Bart,

Quoting Bart De Schuymer <[email protected]>:

> Op wo, 19-04-2006 te 07:19 +0200, schreef Martin Rusko:
>> Hi,
>>
>> please find bellow also my original post regarding subject. Is this
>> expected behavior?
>>
>> When vlan interfaces are created on top of the real NIC (so not over
>> bridged interface), it works. So I would say, that it really looks like
>> bridge is discarding anything bigger than 1500. But this is happening
>> only when /proc/sys/net/bridge/bridge-nf-call-iptables = 0. If this is
>> set to 1, it works.
>
> Packets bigger than the MTU of your network (1500) cannot be sent over
> your network without being fragmented. A bridge doesn't know how to
> fragment packets, so your packets will be dropped. The reason why it
> works with iptables is because connection tracking will fragment the
> (IP) packet for you.

Interesting. I didn't consider such a possibility.

>
>> Problem here is, that I really do not want to see bridged traffic in
>> iptables, because it is causing troubles on another place. :-)
>
> I don't see why you can't come up with a solution. The physdev match can
> tell you whether the packet is bridged or not, so just don't let your
> iptables rules see the bridged packets by accepting them as your first
> rule.

I have one solution. To lower the MTU and optionaly to do MSS clamping, 
to help
at least TCP protocol flow smoothly. For the rest, there are ICMP messages. If
packets don't have DF bit set, then those will be fragmented.

Second option, what you suggested, is to let the iptables see bridged packet,
but immediately accept bridged packets. But I will be always producing
fragments. And my 'issues' with iptables, while bridge-nf code is turned on,
are related to IMQ device. I'm using iptables rules similar to:

iptables -t mangle -A POSTROUTING -s ! 192.168.0.0/16 -o vlan100 -j IMQ 
--todev

iptables -t mangle -A POSTROUTING -s ! 192.168.0.0/16 -o vlan200 -j IMQ 
--todev


The trouble here is, that if iptables are handling bridged packets, 
these rules
don't work! Nothing goes to IMQ device and even counters of those rules 
are not
increased. When I turn off bridge-nf, these rules work! Unfortunately, 
I have no
explanation.

Anyway, Stephen's patch is promising. If I understood it correctly, it 
is doing
exactly, what I would expect. Bridge simply accepts 1504 bytes packets, 
because
real ethernet device will send such a packet as well (I have not issues with
vlan interfaces, when they are created right on the real ethernet 
devices). I'm
willing to test it as soon as possible.

Best Regards,
Martin



----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.



-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642