I have a machine with 2 NICs; eth0 and eth1. Each NIC has an assigned IP address and the traffic between them is controlled using the below script.



/sbin/iptables -I PREROUTING -t mangle -p tcp --syn -j TCP_OPTIMIZATION
/sbin/iptables -I PREROUTING -t nat -p tcp --syn -j TCP_OPTIMIZATION

iptables -t mangle -I TCP_OPTIMIZATION -i eth0 -s -p tcp -j NFQUEUE --queue-num=9
iptables -t nat -I TCP_OPTIMIZATION -i eth0 -s -p tcp -j REDIRECT --to-port 6009

I want to make a bridge between eth0 and eth1 where my machine will be able to be put in between a WAN link without the need to reconfigure any existing source/destination IP and the iptables script above remains effective and does what is written for.

Is there any modification needs to be done in the script in case of a bridge between eth0 and eth1 is implemented?

  • @Nasha Please post answers as answers, not comments. – derobert May 30 '15 at 17:20
  • Your script is using eth0 and eth1. You say you have two NICs—eth1 and eth2. Do you actually have three, eth0, eth1, and eth2? – derobert May 30 '15 at 17:21
  • Done your honour. – user86969 May 30 '15 at 18:32
  • @derobert Sorry it was a typo, I have fixed it. – Adban May 30 '15 at 19:32
  • @derobert : see why I don't rush to post as answers? – user86969 Jun 1 '15 at 8:11

EDIT: This answer is no longer valid.

Just replace eth1 with the bridge interface name, e.g. br0 typically. Preferably eth1 and eth2 should be on separate segments. Otherwise you'll have to enable STP.

  • I have edited the question to have only eth0 and eth1, do I still need to replace eth1 by br0 or eth0 by br0? What do you mean by <separate segments>, different network IP? – Adban May 31 '15 at 11:11
  • Well, that changes everything and my answer is no longer valid for that use case. From my understanding of what you're trying to do, you need at least three interfaces, two of them which are bridge members and one for the WAN connection. With a bridge it's as if there were only one [logical] interface with an IP address. So please expose in your question all the interfaces you have along with their IP addresses so we have a clear idea of what can be done. – user86969 Jun 1 '15 at 7:54
  • A segment is an electrical connection between networked devices with layer 2 forwarding hence does not involve TCP/IP. If you have redundant bridges on the same network then you must enable STP to prevent traffic loops. – user86969 Jun 1 '15 at 8:09
  • I have in my machine 2 physical network interfaces eth0 & eth1, what exactly I am looking for is to make my machine works as plug and plays in between a link which connecting my company head quarter with a remote branch therefore I tried to bridge the two physical interface with keeping iptables does its job descried in the script above. – Adban Jun 3 '15 at 11:56
  • I'd suggest you edited your question and added a scheme including the permanent interfaces along with the temporary ones. Also indicate, which is a VPN (if at all), what interface and IP addresses it provides. What you want is complex enough to justify an exhaustive picture of the full context. Besides I don't see how your script would fit if both interfaces it references are bridged. It's still quite unclear what "your company head quarter" network is and how you connect to it. Is it through OpenVPN? PoPToP? Cisco VPN? Direct link? We really need a detailed picture. – user86969 Jun 4 '15 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.