The effect of net.bridge.bridge-nf-call-iptables on packets in NetFilter

when open:sysctl-w net.bridge.bridge-nf-call-iptables=1

There are interface information for Physin and Physout in SKB, at which point the iptables rule can use-M physdev--physdev-in and-M Physdev--physdev-out to match the physical interface.

Prerouting-mangle-ssh-71:in=br-lan0 out= phy-m physdev--physdev-in=eth1mac=70:f1:a1:aa:bd:60:00:23:cd:9c : e7:0a:08:00 src=192.168.1.254 dst=192.168.1.130 len=92 tos=0x00 prec=0x00 ttl=64 id=25901 DF PROTO=TCP SPT=55377 DPT=22 W indow=16395 res=0x00 ACK PSH urgp=0

When off:sysctl-w net.bridge.bridge-nf-call-iptables=0

There is no interface information for Physin and Physout in SKB, at which point the iptables rule cannot use-M Physdev--physdev-in and-M Physdev-- Physdev-out to match the physical interface.

Prerouting-mangle-ssh-71:in=br-lan0 out= mac=70:f1:a1:aa:bd:60:00:23:cd:9c:e7:0a:08:00 SRC=192.168.1.254 DST= 192.168.1.130 len=52 tos=0x00 prec=0x00 ttl=64 id=26088 DF proto=tcp spt=55757 dpt=22 window=8192 res=0x00 SYN URGP=0

The reasons are:

NET/BRIDGE/BR_NETFILTER.C-br_nf_pre_routing () function in kernel code (corresponding to prerouting in Netfilter/iptables HOOK) has a piece of code to control whether the 2 layer of data is sent to the 3 layer:

#ifdef CONFIG_SYSCTL
if (!brnf_call_iptables)
Return nf_accept;//the ACCEPT action forwards the data directly from Layer 2, without three-layer processing, i.e. the packet SKB will not be processed by iptables chains (prerouting).

#endif

SKB and physical interface-related data structures are Skb->nf_bridge, and the data structure is in NET/BRIDGE/BR_NETFILTER.C--and br_nf_pre_routing () function code Nf_bridge_ Alloc (SKB) is assigned and initialized with the setup_pre_routing () function under the same file.

To configure this parameter:

When the sysctl-w net.bridge.bridge-nf-call-iptables=x command is executed on the Linux command line, the Brnf_sysctl_ in NET/BRIDGE/BR_NETFILTER.C is executed through the system call The Call_tables () function sets the variable static int brnf_call_iptables __read_mostly = 1; The relevant structure is defined as follows:

{
. procname = "Bridge-nf-call-iptables",
. Data = &brnf_call_iptables,
. maxlen = sizeof (int),
. mode = 0644,
. proc_handler = Brnf_sysctl_call_tables,
},

The effect of net.bridge.bridge-nf-call-iptables on packets in NetFilter