br_nf_forward_ip() { parent = bridge_parent(out); NF_HOOK(pf, NF_INET_FORWARD, skb, brnf_get_logical_dev(skb, in), parent, br_nf_forward_finish); } here, i suppose pf = NFPROTO_IPV4, i think the return of brnf_get_logical_dev(skb, in) equals parent ? then when calls iptable_filter_hook to match iptables rules , how to distinct in and out devices? thanks -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.linuxfoundation.org/pipermail/bridge/attachments/20140313/ebca1b24/attachment.html>