How to implement transparent proxy in bridge through nftables

How to implement transparent proxy in bridge through nftables

[Ttttabcd]

In ebtables, I can pull the direct Layer 2 forwarding traffic to the network layer through the "broute" table, but I can't find the "broute" table in nftables.

Later, I want to perform target MAC address redirection in PREROUTING, and change the target MAC to the bridge itself or the MAC of the slave interface, so that the data frame can reach the network layer.

But nftables doesn't seem to be able to perform MAC address redirection in bridge families, so there is no way to use it.

Finally, I searched the Internet for a long time, found br_netfilter, can open bridge-nf-call-iptables to pass the bridge frame to the iptables hook processing, but nftables does not support this feature.

Now I have tried all the methods that I can think of and can search. All of them are not working. I can only come here for help.

Can someone tell me how to run transparent proxy in the bridge with nftables, and the transparent proxy uses the tproxy module.

Does anyone know how to do it?

Re: How to implement transparent proxy in bridge through nftables

[Florian Westphal]

Ttttabcd <ttttabcd@protonmail.com> wrote:
> In ebtables, I can pull the direct Layer 2 forwarding traffic to the network layer through the "broute" table, but I can't find the "broute" table in nftables.

Its not yet implemented, but this will be supported in nft as well at
some point.

> Later, I want to perform target MAC address redirection in PREROUTING, and change the target MAC to the bridge itself or the MAC of the slave interface, so that the data frame can reach the network layer.
> 
> But nftables doesn't seem to be able to perform MAC address redirection in bridge families, so there is no way to use it.
>
> Finally, I searched the Internet for a long time, found br_netfilter, can open bridge-nf-call-iptables to pass the bridge frame to the iptables hook processing, but nftables does not support this feature.
> 
> Now I have tried all the methods that I can think of and can search. All of them are not working. I can only come here for help.
> 
> Can someone tell me how to run transparent proxy in the bridge with nftables, and the transparent proxy uses the tproxy module.
> 
> Does anyone know how to do it?

You can try this example from nft man page, you need to replace the mac
address of course.

bridge prerouting meta pkttype set unicast ether daddr set 00:11:22:33:44:55

Re: How to implement transparent proxy in bridge through nftables

[Ttttabcd]

> You can try this example from nft man page, you need to replace the mac
> address of course.
>
> bridge prerouting meta pkttype set unicast ether daddr set 00:11:22:33:44:55

I have been busy with other things in recent days. I didn’t read the mail. Thank you very much.

This is very helpful. Replace the destination MAC address with the bridge interface MAC address to get the packet to the network layer.

But there is a problem here, that is, the specified MAC address is fixed, this is not universal, I have to modify the command on different devices.

Is there a way for nftables to automatically get the MAC address of the interface?

Re: How to implement transparent proxy in bridge through nftables

[Florian Westphal]

Ttttabcd <ttttabcd@protonmail.com> wrote:
> But there is a problem here, that is, the specified MAC address is fixed, this is not universal, I have to modify the command on different devices.

Yes.

> Is there a way for nftables to automatically get the MAC address of the interface?

Not yet, but we could extend nft/ nft_meta.c so you could do
"ether daddr set meta ifaddr" or something like that.