13

I set up a bridge br0 "attached" to two interfaces:

  • eth0, my physical interface connected to the real LAN,
  • vnet0, a KVM virtual interface (connected to a Windows VM).

And I have this single firewall rule in the forward chain: 

iptables -A FORWARD -j REJECT

Now, the only ping that is working is from the VM to the host.

The br0 interface owns the IP address of my host machine. eth0 and vnet0 do not "own" any IP, from the host point of view. The Windows VM has a static IP configuration.

If change my iptables rule to ACCEPT (or even use a more restrictive iptables -A FORWARD -o br0 -j ACCEPT), everything is working fine! (i.e. I can ping any LAN machine from the VM, and the other way round too).

All IP forwarding kernel options are disabled (like net.ipv4.ip_forward = 0).

So, how can the netfilter firewall block something that is not even enabled?

Furthermore, the VM - LAN traffic should only imply eth0 and vnet0. Yet it looks like allowing FORWARD traffic with -o br0 "works" (I did not check very carefully though).

Totor
  • 19,302
  • 17
  • 75
  • 102
  • Take a look at my A to this U&L Q: [Settings when using a bridge](http://unix.stackexchange.com/questions/125599/settings-when-using-a-bridge/125603#125603) – slm Jun 13 '14 at 12:51
  • 1
    What's the output of `sysctl -a | grep bridge-nf` – Stéphane Chazelas Jun 13 '14 at 13:15
  • @StéphaneChazelas `net.bridge.bridge-nf-call-arptables = 1` `net.bridge.bridge-nf-call-iptables = 1` `net.bridge.bridge-nf-call-ip6tables = 1` `net.bridge.bridge-nf-filter-vlan-tagged = 0` `net.bridge.bridge-nf-filter-pppoe-tagged = 0` – Totor Jun 13 '14 at 14:31

1 Answers1

12

The comment from Stéphane Chazelas provides the hint to the answer.

According to Bridge-nf Frequently Asked Questions bridge-nf enables iptables, ip6tables or arptables to see bridged traffic.

As of kernel version 2.6.1, there are five sysctl entries for bridge-nf behavioral control:

  • bridge-nf-call-arptables - pass bridged ARP traffic to arptables' FORWARD chain.
  • bridge-nf-call-iptables - pass bridged IPv4 traffic to iptables' chains.
  • bridge-nf-call-ip6tables - pass bridged IPv6 traffic to ip6tables' chains.
  • bridge-nf-filter-vlan-tagged - pass bridged vlan-tagged ARP/IP traffic to arptables/iptables.
  • net.bridge.bridge-nf-filter-pppoe-tagged - pass bridged pppoe-tagged IP/IPv6 traffic to {ip,ip6}tables

You can disable netfilter firewall blocking with: 

# sysctl -w net.bridge.bridge-nf-call-iptables=0
# sysctl -w net.bridge.bridge-nf-call-ip6tables=0
Community
  • 1
Mathias Weidner
  • 669
  • 4
  • 10
  • 5
    Since Linux 3.18, the functionality where iptables handles packets from the bridge can be disabled by not loading the `br_netfilter` module. Not having the module loaded also means that there is no `/proc/sys/net/bridge/` entry. – Lekensteyn Aug 20 '16 at 15:10
  • And [since Linux kernel 5.3](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22567590b2e634247931b3d2351384ba45720ebe) this feature becomes per namespace instead of global. – A.B Sep 14 '19 at 10:43