Re: Bridging behavior apparently changed around the Fedora 14 time

[Stephen Hemminger <shemminger@vyatta.com>]

On Mon, 11 Jul 2011 13:25:46 -0500
"Greg Scott" <GregScott@Infrasupport.com> wrote:

> I ran into a strange situation - I am using a firewall set up as a
> bridge.  Physical device eth1 is the private LAN side, eth0 is the
> public Internet side.  I setup bridge br0 to bridge eth0 and eth1
> together.  I need a bridge because this site has a couple of nodes on
> the LAN side that need real public IP Addresses.  
> 
> This site also has a few web and ftp sites.  These are NATed behind the
> firewall, but internal users need to see them the same way as the rest
> of the world.  So I use some iptables SNAT and DNAT rules to make this
> happen.  Device br0 has the relevant public IP Address(es) and then NATs
> to the appropriate private IP Address(es).  The ruleset works and the
> system has been up and running for several years.  
> 
> I recently replaced the old system with a new one running Fedora 14 and
> that's when the weird behavior started.  
> 
> Now, when internal people try to look at those web/ftp sites using the
> public IP Addresses, they get nowhere.  Unless I watch with tcpdump -
> and then while I'm watching , all works as it should.  With some help,
> we figured out the reason it works when watching with tcpdump - because
> tcpdump puts the device being monitored into promiscuous mode.  
> 
> And, sure enough, when I do:
>     ip link set br0 promisc on
> 
> everything works as it should.

Please provide more configuration information like:
  - NIC type
  - iptables and bridge and address configuration

Do you have reverse path filtering enabled/disabled?