linux container bridge filters ARP reply
- by Dani Camps
I am using kernel 3.0, and I have configured a linux container that is bridged to a tap interface in my host computer. This is the bridge configuration:
:~$ brctl show bridge-1
bridge name bridge id STP enabled interfaces
bridge-1 8000.9249c78a510b no ns3-mesh-tap-1
vethjUErij
My problem is that this bridge is dropping ARP replies that come from the ns3-mesh-tap-1 interface. Instead, if I statically populate the ARP tables and ping directly everything works, so it has to be something related to ARP.
I have read about similar problems in related posts, and I have tried with the solutions explained therein but nothing seems to work. Specifically:
~$ grep net.bridge /etc/sysctl.conf
net.bridge.bridge-nf-call-arptables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-filter-vlan-tagged = 0
net.bridge.bridge-nf-filter-pppoe-tagged = 0
arptables and ebtables are not installed.
iptables FORWARD is all set to accept:
Chain FORWARD (policy ACCEPT)
target prot opt source destination
The bridged interfaces are set to PROMISC:
~$ ifconfig
ns3-mesh-tap-1 Link encap:Ethernet HWaddr 1a:c7:24:ef:36:1a
...
UP BROADCAST PROMISC MULTICAST MTU:1500 Metric:1
vethjUErij Link encap:Ethernet HWaddr aa:b0:d1:3b:9a:0a
....
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
The macs learned by the bridge are correct (checked with brctl showmacs).
Any insight on what I am doing wrong would be greatly appreciated.
Best Regards
Daniel
