13

I set up a bridge br0 "attached" to two interfaces:

  • eth0, my physical interface connected to the real LAN,
  • vnet0, a KVM virtual interface (connected to a Windows VM).

And I have this single firewall rule in the forward chain: 

iptables -A FORWARD -j REJECT

Now, the only ping that is working is from the VM to the host.

The br0 interface owns the IP address of my host machine. eth0 and vnet0 do not "own" any IP, from the host point of view. The Windows VM has a static IP configuration.

If change my iptables rule to ACCEPT (or even use a more restrictive iptables -A FORWARD -o br0 -j ACCEPT), everything is working fine! (i.e. I can ping any LAN machine from the VM, and the other way round too).

All IP forwarding kernel options are disabled (like net.ipv4.ip_forward = 0).

So, how can the netfilter firewall block something that is not even enabled?

Furthermore, the VM - LAN traffic should only imply eth0 and vnet0. Yet it looks like allowing FORWARD traffic with -o br0 "works" (I did not check very carefully though).

Improve this question
3
  • Take a look at my A to this U&L Q: Settings when using a bridge
    – slm ♦
    Jun 13, 2014 at 12:51
  • 1
    What's the output of sysctl -a | grep bridge-nf
    – Stéphane Chazelas
    Jun 13, 2014 at 13:15
  • @StéphaneChazelas net.bridge.bridge-nf-call-arptables = 1 net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-filter-vlan-tagged = 0 net.bridge.bridge-nf-filter-pppoe-tagged = 0
    – Totor
    Jun 13, 2014 at 14:31

1 Answer 1

Reset to default
12

The comment from Stéphane Chazelas provides the hint to the answer.

According to Bridge-nf Frequently Asked Questions bridge-nf enables iptables, ip6tables or arptables to see bridged traffic.

As of kernel version 2.6.1, there are five sysctl entries for bridge-nf behavioral control:

  • bridge-nf-call-arptables - pass bridged ARP traffic to arptables' FORWARD chain.
  • bridge-nf-call-iptables - pass bridged IPv4 traffic to iptables' chains.
  • bridge-nf-call-ip6tables - pass bridged IPv6 traffic to ip6tables' chains.
  • bridge-nf-filter-vlan-tagged - pass bridged vlan-tagged ARP/IP traffic to arptables/iptables.
  • net.bridge.bridge-nf-filter-pppoe-tagged - pass bridged pppoe-tagged IP/IPv6 traffic to {ip,ip6}tables

You can disable netfilter firewall blocking with: 

# sysctl -w net.bridge.bridge-nf-call-iptables=0
# sysctl -w net.bridge.bridge-nf-call-ip6tables=0
Improve this answer
2
  • 5
    Since Linux 3.18, the functionality where iptables handles packets from the bridge can be disabled by not loading the br_netfilter module. Not having the module loaded also means that there is no /proc/sys/net/bridge/ entry.
    – Lekensteyn
    Aug 20, 2016 at 15:10
  • And since Linux kernel 5.3 this feature becomes per namespace instead of global.
    – A.B
    Sep 14, 2019 at 10:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .