iptables的physdev配置说明 --physdev-in --physdev-out --physdev-is-in --physdev-is-out

http://ipset.netfilter.org/iptables-extensions.man.html

physdev

This module matches on the bridge port input and output devices enslavedto a bridge device. This module is a part of the infrastructure that enablesa transparent bridging IP firewall and is only useful for kernel versionsabove version 2.5.44.

[!] --physdev-in name

Name of a bridge port via which a packet is received (only forpackets entering theINPUT,FORWARDandPREROUTINGchains). If the interface name ends in a "+", then anyinterface which begins with this name will match. If the packet didn't arrivethrough a bridge device, this packet won't match this option, unless '!' is used.

[!] --physdev-out name

Name of a bridge port via which a packet is going to be sent (for packetsentering theFORWARD,OUTPUTandPOSTROUTINGchains). If the interface name ends in a "+", then anyinterface which begins with this name will match. Note that in thenat and mangleOUTPUTchains one cannot match on the bridge output port, however one can in thefilter OUTPUTchain. If the packet won't leave by a bridge device or if it is yet unknown whatthe output device will be, then the packet won't match this option,unless '!' is used.

[!] --physdev-is-in

Matches if the packet has entered through a bridge interface.

[!] --physdev-is-out

Matches if the packet will leave through a bridge interface.

[!] --physdev-is-bridged

Matches if the packet is being bridged and therefore is not being routed.This is only useful in the FORWARD and POSTROUTING chains.

----------------------------------------------------------------------------------------------------------------------

编译内核时，检查一下 CONFIG_SYSCTL

----------------------------------------------------------------------------------------------------------------------

gedit kernel/net/bridge/br_netfilter_hooks.c

#ifdef CONFIG_SYSCTL
static
int brnf_sysctl_call_tables(struct ctl_table *ctl, int write,
			    void __user *buffer, size_t *lenp, loff_t *ppos)
{
	int ret;

	ret = proc_dointvec(ctl, write, buffer, lenp, ppos);

	if (write && *(int *)(ctl->data))
		*(int *)(ctl->data) = 1;
	return ret;
}

static struct ctl_table brnf_table[] = {
	{
		.procname	= "bridge-nf-call-arptables",
		.data		= &brnf_call_arptables,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= brnf_sysctl_call_tables,
	},
	{
		.procname	= "bridge-nf-call-iptables",
		.data		= &brnf_call_iptables,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= brnf_sysctl_call_tables,
	},
	{
		.procname	= "bridge-nf-call-ip6tables",
		.data		= &brnf_call_ip6tables,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= brnf_sysctl_call_tables,
	},
	{
		.procname	= "bridge-nf-filter-vlan-tagged",
		.data		= &brnf_filter_vlan_tagged,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= brnf_sysctl_call_tables,
	},
	{
		.procname	= "bridge-nf-filter-pppoe-tagged",
		.data		= &brnf_filter_pppoe_tagged,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= brnf_sysctl_call_tables,
	},
	{
		.procname	= "bridge-nf-pass-vlan-input-dev",
		.data		= &brnf_pass_vlan_indev,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= brnf_sysctl_call_tables,
	},
	{ }
};
#endif