I've been doing some experimenting with iptables and bridges, and this scenario is just in a lab, but I've encountered some interesting functionality and would like some explanation as to what is happening (as it doesnt make sense when compared to the iptables flowcharts).
I have 3 interfaces on a Debian 11 server vm. ens3 is connected to the "internet" (lab external), ens4 is connected to the lab router, and ens5 is addressed and connected to a subnet inside the lab. ens3 and ens4 have no IP address.
I have created a bridge, br0, which contains the interfaces ens3 and ens4. This works perfectly fine, traffic coming from the "internet" or the lab router is moved properly between ens3 and ens4.
I have enabled br_netfilter kernel module, and enabled net.bridge.bridge-nf-call-iptables = 1
in an attempt to make bridged traffic seen by iptables.
The goal I have set for myself is to grab packets coming from the "internet" that match a certain port (22, SSH) and change the destination IP address to the IP of ens5.
If I add a blank rule (just to see the counters incrementing), iptables -t raw -A PREROUTING
, then the pkt counter starts incrementing. So the traffic is seen at the raw PREROUTING
chain.
If I add another blank rule, iptables -t mangle -A PREROUTING
, then the pkt counter again starts incrementing. So the traffic is following the flowchart so far.
Heres where it gets interesting. If I add another blank rule to iptables -t nat -A PREROUTING
suddenly the pkt counter does NOT increment. But the flowchart states that traffic will flow from mangle PREROUTING
to nat PREROUTING
. But this clearly isn't happening.
Is there any flowcharts for how linux bridges interact with iptables chains? I am confused as to how/where the traffic is disappearing/going to.
I already have a rule written up for a DNAT rule, but I can only place that DNAT rule into nat PREROUTING
, and if traffic is never seen by nat PREROUTING
, then I cannot rewrite the destination IP. Unless there is a way to do DNAT in raw or mangle, but I am unaware of those methods.