bugzilla-daemon at netfilter.org
2017-Apr-04 14:15 UTC
[Bug 1143] New: physdev extension not working
https://bugzilla.netfilter.org/show_bug.cgi?id=1143 Bug ID: 1143 Summary: physdev extension not working Product: iptables Version: 1.4.x Hardware: x86_64 OS: Debian GNU/Linux Status: NEW Severity: normal Priority: P5 Component: iptables Assignee: netfilter-buglog at lists.netfilter.org Reporter: phaoost at gmail.com Hello, I find physdev match is not working. I am trying to drop tcp traffic on bridged port but it shows no effect: I run on machine with bridge: ~# brctl show|grep tap40 tap40 ~# iptables -I FORWARD -m physdev --physdev-is-bridged --physdev-out tap40 -p tcp -j DROP Then from other machine I am trying to reach the IP behind tap40 interface with telnet and getting connected. ~# iptables -nvL|grep phy 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out tap40 --physdev-is-bridged I find the physdev match has no effect. -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170404/2a445519/attachment.html>
Reasonably Related Threads
- Bug#571634: xen-utils-common: using --physdev-out in the OUTPUT, FORWARD and POSTROUTING
- [Bug 985] New: iptables-save cannot display devgroup rule the right way?
- Bug#571634: [xen-utils-common] using --physdev-out in the OUTPUT, FORWARD and POSTROUTING
- [Bug 751] New: IPv6 bridging bug
- Bug#571634: xen-utils-common - using --physdev-out in the OUTPUT, FORWARD and POSTROUTING chains for non-bridged traffic