Policy match with a bridge
Mon Aug 16 02:31:44 CEST 2004
Tom Eastep wrote:
> | Have you applied the ipsec+netfilter patches ? Without them, packets
> | only seen encrypted in the OUTPUT chain.
> Yes -- the ipsec+netfilter patches are applied. Here is the same test
> with the bridge removed and the local ip address transfered to one of
> the network cards:
The problem is ipv4_sabotage_out in the briding code. It prevents the
packet from hitting the LOCAL_OUT hook while it is still unencrypted.
When it hits the bridging code and its LOCAL_OUT hook it's too late.
Not sure how to handle it yet.
More information about the netfilter-devel