avoiding bridged packets in iptables: does --physdev-is-bridged do what I want?

Hi all,

[[I guess this is more of a question about iptables than ebtables, but
since it concerns the way iptables is modified in the presence of
CONFIG_BRIDGE_NETFILTER, I thought this might be the right place to
ask.  Sorry if I got that wrong.]]

Just for clarification:

I'm a bit confused as to the logic behind the idea that bridged
packets go through such iptables as the filter/FORWARD and
nat/POSTROUTING chains.  So assume that - either because I think it's
wrong or simply because I can't understand it and don't need it - I
want to avoid that.  I believe the right thing to do is simply add a
rule

-m physdev --physdev-is-bridged -j ACCEPT

at the very start of my filter/FORWARD and nat/POSTROUTING chains in
iptables.  Is this correct, or am I missing something?  Will this
ensure that routing and bridging stay clearly separated?

I ask this because the document <URL:
http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html
 > does not mention this possibility at all (I guess it appeared after
the document was written, or something).  Might the example line

iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -d 172.16.1.0/24 -j ACCEPT

be replaced by what I suggest:

iptables -t nat -A POSTROUTING -m physdev --physdev-is-bridged -j ACCEPT

?

How about PREROUTING?  Is it possible/meaningful/useful to use such a
rule there?

Thanks for any clarification/correction/confirmation!

-- 
     David A. Madore
    ([email protected],
     http://www.madore.org/~david/ )

-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace