[Bridge] Problems with stateful firewall and bridge

Richard Kenner kenner at gnat.com
Thu Nov 17 03:27:15 UTC 2011

I'm running into problems with a stateful firewall on a bridge device.
The Linux kernel is 2.6.37.

The problem appears to be that no connection tracking entries are
being made.  conntrack -L shows no entries.

But sysctl appears to be set correctly:

net.bridge.bridge-nf-call-arptables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-filter-vlan-tagged = 0
net.bridge.bridge-nf-filter-pppoe-tagged = 0

Does anybody have any suggestions as to what I should look at next?

More information about the Bridge mailing list