[arch-general] What's the holdup on Linux 3.18?
lisaev at umail.iu.edu
Thu Jan 8 20:17:00 UTC 2015
On Thu, Jan 08, 2015 at 07:18:25PM +0000, Mauro Santos wrote:
> On 08-01-2015 18:57, Leonid Isaev wrote:
> > BTW, to those updating, one notable (at least from my perspective) change with
> > 3.18.y is the new module br_netfilter responsible for filtering traffic coming
> > through a bridge. This module is not loaded automatically, so no firewall is
> > enabled by default in bridges. Here is a dmesg snippet:
> > ---
> > kernel: [ 23.690774] bridge: automatic filtering via arp/ip/ip6tables has
> > been deprecated. Update your scripts to load br_netfilter if you need this.
> > ---
> I'm not sure I'm reading it right and a quick google search doesn't turn
> up much besides this. Does this apply to filtering via iptables
> (traffic from/to localhost to/from machines on the bridge) or more
> specifically to ebtables (filter traffic between machines on the bridge)?
>  http://ebtables.netfilter.org/documentation/bridge-nf.html
The former. It applies to filtering traffic passing through the bridge. If the
module is loaded and /proc/sys/net/bridge/bridge-nf-* == 1 then you should be
able to manipulate traffic _inside_ the bridge using iptables FORWARD chain. If
the module is not loaded, or the above files contain 0, then the bridge acts as
a "dumb" switch. So, you can use the FORWARD chain to forward packets _between_
the bridge and some other interface.
The warning is because with linux < 3.18, bridge-netfilter was enabled by
default, so you'd need a service that nullifies bridge-nf-*. Now, the module is
not loaded by default, so the files are not there, and the existing service
will fail. Basically there is no need to do what is suggested in  and .
(Note, that the sysctl was never the right approach to begin with, no idea who
put it in thw wiki).
GPG fingerprints: DA92 034D B4A8 EC51 7EA6 20DF 9291 EE8A 043C B8C4
C0DF 20D0 C075 C3F1 E1BE 775A A7AE F6CB 164B 5A6D
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 819 bytes
Desc: not available
More information about the arch-general