netfilter buglog - Apr 2017 - [Bug 1143] New: physdev extension not working

https://bugzilla.netfilter.org/show_bug.cgi?id=1143

            Bug ID: 1143
           Summary: physdev extension not working
           Product: iptables
           Version: 1.4.x
          Hardware: x86_64
                OS: Debian GNU/Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: iptables
          Assignee: netfilter-buglog at lists.netfilter.org
          Reporter: phaoost at gmail.com

Hello,

I find physdev match is not working.

I am trying to drop tcp traffic on bridged port but it shows no effect:

I run on machine with bridge:

~# brctl show|grep tap40
                                                        tap40
~# iptables -I FORWARD -m physdev --physdev-is-bridged --physdev-out tap40 -p
tcp -j DROP

Then from other machine I am trying to reach the IP behind tap40 interface with
telnet and getting connected.

~# iptables -nvL|grep phy
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0  
         PHYSDEV match --physdev-out tap40 --physdev-is-bridged

I find the physdev match has no effect.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170404/2a445519/attachment.html>