iptables的physdev配置说明 --physdev-in --physdev-out --physdev-is-in --physdev-is-out
来源:互联网 发布:福州海牛网络压力大吗 编辑:程序博客网 时间:2024/05/18 01:42
http://ipset.netfilter.org/iptables-extensions.man.html
physdev
This module matches on the bridge port input and output devices enslavedto a bridge device. This module is a part of the infrastructure that enablesa transparent bridging IP firewall and is only useful for kernel versionsabove version 2.5.44.- [!] --physdev-in name
- Name of a bridge port via which a packet is received (only forpackets entering theINPUT,FORWARDandPREROUTINGchains). If the interface name ends in a "+", then anyinterface which begins with this name will match. If the packet didn't arrivethrough a bridge device, this packet won't match this option, unless '!' is used.
- [!] --physdev-out name
- Name of a bridge port via which a packet is going to be sent (for packetsentering theFORWARD,OUTPUTandPOSTROUTINGchains). If the interface name ends in a "+", then anyinterface which begins with this name will match. Note that in thenat and mangleOUTPUTchains one cannot match on the bridge output port, however one can in thefilter OUTPUTchain. If the packet won't leave by a bridge device or if it is yet unknown whatthe output device will be, then the packet won't match this option,unless '!' is used.
- [!] --physdev-is-in
- Matches if the packet has entered through a bridge interface.
- [!] --physdev-is-out
- Matches if the packet will leave through a bridge interface.
- [!] --physdev-is-bridged
- Matches if the packet is being bridged and therefore is not being routed.This is only useful in the FORWARD and POSTROUTING chains.
----------------------------------------------------------------------------------------------------------------------
编译内核时,检查一下 CONFIG_SYSCTL
----------------------------------------------------------------------------------------------------------------------
gedit kernel/net/bridge/br_netfilter_hooks.c
#ifdef CONFIG_SYSCTLstaticint brnf_sysctl_call_tables(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos){int ret;ret = proc_dointvec(ctl, write, buffer, lenp, ppos);if (write && *(int *)(ctl->data))*(int *)(ctl->data) = 1;return ret;}static struct ctl_table brnf_table[] = {{.procname= "bridge-nf-call-arptables",.data= &brnf_call_arptables,.maxlen= sizeof(int),.mode= 0644,.proc_handler= brnf_sysctl_call_tables,},{.procname= "bridge-nf-call-iptables",.data= &brnf_call_iptables,.maxlen= sizeof(int),.mode= 0644,.proc_handler= brnf_sysctl_call_tables,},{.procname= "bridge-nf-call-ip6tables",.data= &brnf_call_ip6tables,.maxlen= sizeof(int),.mode= 0644,.proc_handler= brnf_sysctl_call_tables,},{.procname= "bridge-nf-filter-vlan-tagged",.data= &brnf_filter_vlan_tagged,.maxlen= sizeof(int),.mode= 0644,.proc_handler= brnf_sysctl_call_tables,},{.procname= "bridge-nf-filter-pppoe-tagged",.data= &brnf_filter_pppoe_tagged,.maxlen= sizeof(int),.mode= 0644,.proc_handler= brnf_sysctl_call_tables,},{.procname= "bridge-nf-pass-vlan-input-dev",.data= &brnf_pass_vlan_indev,.maxlen= sizeof(int),.mode= 0644,.proc_handler= brnf_sysctl_call_tables,},{ }};#endif
阅读全文
0 0
- iptables的physdev配置说明 --physdev-in --physdev-out --physdev-is-in --physdev-is-out
- iptables & physdev-is-in & physdev-is-out -- net.bridge.bridge-nf-call-iptables对Netfilter中数据包的影响
- iptables支持physdev参数
- BIGINT UNSIGNED value is out of range in..的解决方法
- Apple Profiling Tools – Shark is Out, Instruments is In
- In Wired Connection settings save option is getting grayed out
- Mysql ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in..的解决方法
- Mysql ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in..的解决方法
- Mysql ERROR 1690 (22003): BIGINT UNSIGNED value is out of range in..的解决方法
- one of arguments' values is out of range (index is out of range) in function cvPtr2D,c:\\
- 关于宏IN、OUT和INOUT的说明
- in out in/out 三种参数的区别
- ACL的in和out
- procedure in out的使用
- Gaim0.79 is out!
- ora-03206 maximum file size of blocks in autoextend clause is out of range
- deployment is out of date due to changes in tho underlying project contents
- How to figure out what package something is in without resorting to Google
- 乱码问题
- git reset
- Hibernate一对多映射_学习笔记
- HTML5和CSS编写规范
- Java序列化和反序列化
- iptables的physdev配置说明 --physdev-in --physdev-out --physdev-is-in --physdev-is-out
- I/O多路转接之poll
- XMind思维导图安装步骤
- Sublime Text3の右键菜单设置-yellowcong
- Vim技能修炼教程(10)
- removeFromSuperviews删除
- Quartz与spring的整合
- DQL、DML、DDL、DCL的概念与区别
- esp8266 wifi模块的使用