I have KVM virtualization. I have over 60 interfaces:

vnet1-60 - virtual;
vmbr0 - bridge;
enp2s0f0 - PHYSOUT;

I need to know how many connection make each vnet interface. I have a rule like:

iptables -A FORWARD -o vnet1 -m state -p tcp --dport 25 --state NEW -j 
LOG --log-level 7 --log-prefix "25port: "

... but no result. Same no result:

-A OUTPUT -o vnet*;
-A OUTPUT -o vnet55,vnet56; 
-A OUTPUT -o enp2s0f0;

I get logs only when I use this:

-A FORWARD -o vmbr0 -s -m state -p tcp --dport 25 --state 
NEW -j LOG --log-level 7 --log-prefix "25port: "

... but this is not correct, because vmbr is the bridge. How I can get traffic logs from virtual interfaces on port 25?


1 Answer 1


You need to load the br_netfilter module, and then enable iptables for bridged traffic, by means of

echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables

See "What's bridge-netfilter?"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .