From: Florian Westphal <fw@strlen.de>
To: Ttttabcd <ttttabcd@protonmail.com>
Cc: "netfilter-devel@vger.kernel.org" <netfilter-devel@vger.kernel.org>
Subject: Re: How to implement transparent proxy in bridge through nftables
Date: Tue, 22 Oct 2019 15:25:33 +0200 [thread overview]
Message-ID: <20191022132533.GJ25052@breakpoint.cc> (raw)
In-Reply-To: <0nkwkdhigGlVkVliaeVhuQ2wMq-np7v0sEG1lwiwI8fKYJg8plX19uqIPiONNMpUQbIluwVsyIPsVyEs7MTE_zGRJWgaYCYdchwRs16fRHk=@protonmail.com>
Ttttabcd <ttttabcd@protonmail.com> wrote:
> In ebtables, I can pull the direct Layer 2 forwarding traffic to the network layer through the "broute" table, but I can't find the "broute" table in nftables.
Its not yet implemented, but this will be supported in nft as well at
some point.
> Later, I want to perform target MAC address redirection in PREROUTING, and change the target MAC to the bridge itself or the MAC of the slave interface, so that the data frame can reach the network layer.
>
> But nftables doesn't seem to be able to perform MAC address redirection in bridge families, so there is no way to use it.
>
> Finally, I searched the Internet for a long time, found br_netfilter, can open bridge-nf-call-iptables to pass the bridge frame to the iptables hook processing, but nftables does not support this feature.
>
> Now I have tried all the methods that I can think of and can search. All of them are not working. I can only come here for help.
>
> Can someone tell me how to run transparent proxy in the bridge with nftables, and the transparent proxy uses the tproxy module.
>
> Does anyone know how to do it?
You can try this example from nft man page, you need to replace the mac
address of course.
bridge prerouting meta pkttype set unicast ether daddr set 00:11:22:33:44:55
next prev parent reply other threads:[~2019-10-22 13:25 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-22 13:04 How to implement transparent proxy in bridge through nftables Ttttabcd
2019-10-22 13:25 ` Florian Westphal [this message]
2019-10-24 7:57 ` Ttttabcd
2019-10-24 11:46 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191022132533.GJ25052@breakpoint.cc \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=ttttabcd@protonmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).