How to define iptables rule to add all transport to a given interface to nfqueue

    • Running on Ubuntu. I have machine 1 < - > machine 2 < - > machine 3. I dont know machine 1 or machine 3 ip. It can be any ip. machine 1 send packet to machine 3 and machine 3 send packet to machine 1.

      Machine 2 is used as a bridge:

      ifconfig eth0 0.0.0.0
      ifconfig eth2 0.0.0.0
      brctl addbr br0
      brctl addif br0 eth0 eth2
      ifconfig br0 up
      

      i want to have an iptable rule in machine 2 that will add all traffic that come to eth0 to nfqueue1 and all traffic that come to eth2 to nefqueue2.

      Now i have the following rule:

      iptables -A FORWARD -p tcp -j NFQUEUE --queue-num 0
      

      which is not good to me because i want to distinguish between traffic that come from machine 3 to traffic that come from machine 1, so i want to have 2 rule.

      Add -i eth0 to the rule doesn’t help.

    Answers(18)

    • iptables -A FORWARD -m physdev --physdev-in eth0 .... work!!!! great!!! – Avihai Marchiano Aug 13 '12 at 7:15

    • Can you just add a -s specifier? – larsks Aug 12 '12 at 12:20

    • iptables -A FORWARD -m physdev --physdev-in eth0 .... work!!!! great!!! – Avihai Marchiano Aug 13 '12 at 7:15

    • The ip of the machines is not known its group of machines. – Avihai Marchiano Aug 12 '12 at 13:05

    • because the incoming interface is considered to be the bridge interface ( br0 ), not the bridge port. – Olipro Aug 12 '12 at 20:18

    • because the incoming interface is considered to be the bridge interface ( br0 ), not the bridge port. – Olipro Aug 12 '12 at 20:18

    • since you're operating a bridge, you need to use -m physdev

      for usage, run iptables -m physdev -h - if you compile your own kernel, you may need to add this module.

    • Ah, that wasn't clear. – larsks Aug 12 '12 at 13:06

    • Right, and I'm suggesting that you use the source ip address to distinguish machine 1 from machine 3 (I'm not suggesting blocking traffic). You would need two rules in your FORWARD chain instead of 1... – larsks Aug 12 '12 at 12:54

        • Can you just add a -s specifier? – larsks Aug 12 '12 at 12:20

          • since you're operating a bridge, you need to use -m physdev

            for usage, run iptables -m physdev -h - if you compile your own kernel, you may need to add this module.

          • 10x i will test it tommorow. Why -i interfacename dosnt work ? – Avihai Marchiano Aug 12 '12 at 16:44

            • No . All trafic allowed but i need to distinguish between traffic from machine 1 to machine 3 – Avihai Marchiano Aug 12 '12 at 12:32

            • The ip of the machines is not known its group of machines. – Avihai Marchiano Aug 12 '12 at 13:05

              • Ah, that wasn't clear. – larsks Aug 12 '12 at 13:06

              • Right, and I'm suggesting that you use the source ip address to distinguish machine 1 from machine 3 (I'm not suggesting blocking traffic). You would need two rules in your FORWARD chain instead of 1... – larsks Aug 12 '12 at 12:54

              • No . All trafic allowed but i need to distinguish between traffic from machine 1 to machine 3 – Avihai Marchiano Aug 12 '12 at 12:32

              • 10x i will test it tommorow. Why -i interfacename dosnt work ? – Avihai Marchiano Aug 12 '12 at 16:44