bridge + 802.1q + NAT

Greetings,

I´m using bridge-nf in a following environment:

Physical (summary):
MyNet_invalid <-> bridge-nf <-> Internet

Logical:
10.0.0.0/8 <-> router <-> bridge-nf <-> 200.xx.223.17
Where 200.xx.223.17 injects default route by OSPF in my_network.
10.0.0.0/8 are our customers´ network, and the linux bridge is nat´ng
this to a SNAT:
"iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j SNAT --to 200.xx.223.20"
200.xx.223.20 is the ip address assigned to br0
In this environment, everything is working fine.

However...

I need to aggregate more than one router now. And run ospf in both
sides. And NAT invalid networks. I assume this environment:

MyNet_invalid_1 <---VL_tag_501---> bridge <---VL_tag_501---> router_internet
MyNet_invalid_2 <---VL_tag_502---> bridge <---VL_tag_502---> router_internet
                                                     bridge
<-----untagged-----> router_internet

All these links are 802.1q VLAN of ethernet ports (eth0 and eth1). I
did the following commands:
# ifconfig eth0 0.0.0.0/0
# ifconfig eth1 0.0.0.0/0
# brctl addbr br0
# brctl addif eth0
# brctl addif eth1
At this point, I have connectivity between router_internet and mynet_*
(all routing are already set and working)

# ifconfig br0 200.xx.209.195
Now bridge can connect my_net_valid router_internet (ip 200.xx.209.193/27)

MyNet_invalid_1 have router_internet (tag_501) interface as their
default route. Also MyNet_invalid_2 have router_internet (tag_502)
interface as their default route. Both MyNet_invalid_1 and
MyNet_invalid_2 is in the 10.0.0.0/8 range. So I did this command:
# iptables -t nat -A POSTROUTING -j SNAT --to 200.xx.209.195

And MyNet_invalid* losts connectivity to the router_internet.

The challenge is NAT all traffic coming from MyNet_invalid to the
internet, using the valid IP address connected by untagged packets in
the same physical port. Note that I have just configure an ip address
for the untagged port.

One curious thing is that iptables can see even 802.1q encapsulated
packets and NAT them.

I wonder if I should use ebtables to make this working.

System:
Linux 2.6.11-gentoo-r3
compiled with 802.1q support, bridge support, netfilter support.
bridge utils 1.0.6

I´ll really appreciate any tips and clues. If you need more info,
please post a message to me.

TIA,
Edgar Shine


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf