iptables loopback local traffic with masc?

jfuerst · 03-22-2010, 06:17 PM

I have a bridge set up using brctl that has 2 interfaces, eth0 and tap0.

What I would like to do is change the stack so that:
If a packet comes into interface tap0 AND is destined for some device on tap0 THEN I would like to forward it back out of tap0 instead of the default, which would be to drop the packet. Also if it is possible it would be great to be able to masquerade these packets.

I was thinking that this would be possible with iptables with something like:

iptables -a FORWARD -m physdev --physdev-in tap0 physdev --physdev-out tap0 ACCEPT

Or something like that to get these packets to echo back out the tap0 port, but that doesn't seem to work. Also I am not clear on how I would masquerade just these packets.

Essentially I have a program that collects data from several places and feeds the data into the IP bridge using a tap interface. The problem is that these devices can not talk to one-another since they are all located on what the bridge sees as a single device. This is similar to trying to do the same thing a a wireless bridge must do to allow two laptops to talk to each other of the same wifi access point.

Any help is greatly appreciated,

Thanks,

-j

nimnull22 · 03-22-2010, 07:49 PM

Code:

   REDIRECT
       This target is only valid in the nat table, in the  PREROUTING  and  OUTPUT  chains,  and
       user-defined  chains which are only called from those chains.  It redirects the packet to
       the machine itself by changing the destination IP to the primary address of the  incoming
       interface (locally-generated packets are mapped to the 127.0.0.1 address).

       --to-ports port[-port]
              This specifies a destination port or range of ports to use: without this, the des-
              tination port is never altered.  This is only valid if the rule also specifies  -p
              tcp or -p udp.

       --random
              If  option  --random  is  used  then  port  mapping  will be randomized (kernel >=
              2.6.22).

Can this help you?