Setting IP forwarding with a bridge

Question

I'm familiar with how to set IP forwarding between two interfaces, and it always worked. Now I have a different scenario where I want to set IP forwarding from a local network bridge to an output interface.

                        lan0
eno1 < --- > bridge0 -< 
                        lan1

I used the following commands:

sysctl net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING --out-interface eno1 -j MASQUERADE
iptables -A FORWARD --in-interface bridge0 -j ACCEPT

And tried to ping 8.8.8.8 from wlan0

Using tcpdump I can see the packets go up to the eno1 and I get ping reply. but it is not forwarded back from eno1 to bridge0.

Am I missing something beacuse I'm using a bridge ?

Some requested outputs:

root@mclaren:/home/ramon# ip -br link
lo               UNKNOWN        00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP>
eno1             UP             f0:d4:e2:eb:c9:9c <BROADCAST,MULTICAST,UP,LOWER_UP>
    <BROADCAST,MULTICAST,UP,LOWER_UP>
bridge0          UP             a6:13:ed:28:be:7a <BROADCAST,MULTICAST,UP,LOWER_UP>
lan0      UNKNOWN        7a:46:b3:ea:a2:92 <BROADCAST,UP,LOWER_UP>
lan1      UNKNOWN        fa:2b:35:57:5c:44 <BROADCAST,UP,LOWER_UP>

root@mclaren:/home/ramon# ip -4 -br address
lo               UNKNOWN        127.0.0.1/8
eno1             UP             172.23.1.107/24
bridge0          UP             192.168.0.254/32

root@mclaren:/home/ramon# ip route
default via 172.23.1.254 dev eno1 proto dhcp src 172.23.1.107 metric 100
172.23.1.0/24 dev eno1 proto kernel scope link src 172.23.1.107
172.23.1.254 dev eno1 proto dhcp scope link src 172.23.1.107 metric 100
192.168.0.0/24 dev bridge0 scope link src 192.168.0.254

root@mclaren:/home/ramon# ip -4 neigh
172.23.1.111 dev eno1 lladdr 1c:98:ec:1a:d5:c0 STALE
192.168.0.50 dev bridge0 FAILED
192.168.0.97 dev bridge0lladdr 0a:a0:db:c0:ab:91 STALE
172.23.1.105 dev eno1  FAILED
192.168.0.25 dev bridge0 lladdr 0a:a0:db:c0:41:f4 STALE
172.23.1.130 dev eno1  FAILED
172.23.1.254 dev eno1 lladdr e0:23:ff:d0:b8:22 REACHABLE
172.23.1.163 dev eno1 lladdr e0:70:ea:01:18:6e STALE
192.168.0.33 dev bridge0 lladdr 0a:a0:db:c0:a0:0d STALE

root@mclaren:/home/ramon# bridge link
124: lan0: <BROADCAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100
164: lan1: <BROADCAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 32 cost 100

root@mclaren:/home/ramon# iptables-save -c
# Generated by iptables-save v1.8.7 on Sat Aug 27 18:53:58 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [22529:1892750]
:OUTPUT ACCEPT [0:0]
[0:0] -A FORWARD -i bridge0 -j ACCEPT
COMMIT
# Completed on Sat Aug 27 18:53:58 2022
# Generated by iptables-save v1.8.7 on Sat Aug 27 18:53:58 2022
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
[13:990] -A POSTROUTING -o eno1 -j MASQUERADE
[0:0] -A POSTROUTING -o eno1 -j MASQUERADE
COMMIT
# Completed on Sat Aug 27 18:53:58 2022

Can you give more detail on the network setup? I doubt that wlan0 and wlan1 are bridge ports, because you'd have to be the access point (AP) in most default configuration. If they are not bridge ports then something else (routing) might be missing. Can you give the output of: ip -br link; ip -4 -br address; ip route; ip -4 neigh; bridge link. And then also the output of iptables-save -c. Also if you are using special software affecting network like Docker, please tell so. — A.B
– A.B, Commented Aug 24, 2022 at 17:51
As A.B. mentioned, bridging WiFi interfaces is very subtle topic. Actually, this is not about "most default configuration". Only AP can really bridge wireless ports. Otherwise, it is impossible. I'll write this again, in case somebody misunderstood it: direct bridging of wireless interfaces (with anything) is only possible on the access point and never possible on the AP client. This is due to wireless packet format; explained, for example, on MikroTik wiki. — Nikita Kipriyanov
– Nikita Kipriyanov, Commented Aug 24, 2022 at 18:32
That said, tricks are possible, like "bridge MAC address translation" (sometimes incorrectly called "bridge NAT"), which make this almost work. Almost, because there will be still many problems with DHCP and other things that rely on MAC addresses. — Nikita Kipriyanov
– Nikita Kipriyanov, Commented Aug 24, 2022 at 18:37
@NikitaKipriyanov to be thorough (and I agree that most questions around won't be able to use that) it's possible by adding the "optional" 4th MAC address on the Wifi frame, but requires support from both AP and all clients, with hardware, firmware and OS. Eg on Linux: wireless.wiki.kernel.org/en/users/documentation/… . — A.B
– A.B, Commented Aug 24, 2022 at 19:10
... and that also was written under the link I mentioned, and explained what are the caveats. Theoretically yes, you can do that (though you need to sell your soul to the devil), in practice I had never seen it working. — Nikita Kipriyanov
– Nikita Kipriyanov, Commented Aug 25, 2022 at 3:04

A.B · Accepted Answer · 2022-09-02 14:37:27Z

Your firewall ruleset prevents return traffic:

*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [22529:1892750]
:OUTPUT ACCEPT [0:0]
[0:0] -A FORWARD -i bridge0 -j ACCEPT
COMMIT

[...]

This allows traffic received from the bridge interface to anywhere else. But nothing allows traffic received from anywhere to the bridge interface. Thus when the ping repliy arrives, the default policy is applied: drop.

You could simply do this:

iptables -A FORWARD -o bridge0 -j ACCEPT

or instead you can use stateful firewalling to allow (only) replies:

iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Among other things (like alternate data flows for protocols like FTP, which requires additional settings) the RELATED traffic includes related ICMP errors, so UDP errors can be received back, or Path MTU Discovery can work correctly.

Nothing in this answer is related to the use of a bridge.

With Docker around, you might have to ponder if you should instead insert these rules in the DOCKER-USER chain (because Docker might append something to it) instead of the FORWARD chain (see details there to know if you need it or not).

iptables -N DOCKER-USER || true # so it works whether Docker was started before or not
iptables -I DOCKER-USER 1 -o bridge0 -j ACCEPT
iptables -I DOCKER-USER 2 ...

or

iptables -N DOCKER-USER || true
iptables -I DOCKER-USER 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
...

Now with Docker around, things can become related to the use of a bridge instead of a normal interface. This should then probably be added in FORWARD or possibly in DOCKER-USER, else bridged traffic between lan0 and lan1 might be disrupted:

iptables -A -m physdev --physdev-is-bridged -j ACCEPT

Related Q/As about this Docker problem: here, here or there. It's quite advanced topic. In short: don't do network experiments on a system where Docker has already changed network settings/firewall settings.

Stack Exchange Network

Setting IP forwarding with a bridge

1 Answer 1

You must log in to answer this question.

Linked

Hot Network Questions