我正在尝试将网桥上的dnsstream量转发到本地dns服务器，并且无法正常工作。 作为一个思想练习，我决定阻止所有的stream量，这也是行不通的。 这是我的设置：
#/etc/network/interfaces auto lo iface lo inet loopback iface eth0 inet manual iface eth1 inet manual #allow-hotplug br0 auto br0 iface br0 inet static bridge_ports eth0 eth1 address 192.168.1.2 netmask 255.255.255.0 gateway 192.168.1.1 sudo iptables -L结果（MAC地址是eth0和eth1）：
Chain INPUT (policy DROP) target prot opt source destination DROP udp -- anywhere anywhere udp dpt:domain DROP tcp -- anywhere anywhere tcp dpt:domain DROP all -- anywhere anywhere MAC 10:6A:FD:32:07:7F DROP all -- anywhere anywhere MAC B7:23:EC:30:BE:B7 Chain FORWARD (policy DROP) target prot opt source destination DROP all -- anywhere anywhere DROP all -- anywhere anywhere Chain OUTPUT (policy DROP) target prot opt source destination DROP all -- anywhere anywhere DROP all -- anywhere anywhere
ifconfig结果：
br0 Link encap:Ethernet HWaddr 10:6A:FD:32:07:7F inet addr:192.168.1.2 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: 2602:30a:c038:f980::3ec/128 Scope:Global inet6 addr: fe80::129a:ddff:fe41:907d/64 Scope:Link inet6 addr: 2602:30a:c038:f980:6806:dd7b:14eb:a2b0/64 Scope:Global UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:558 errors:0 dropped:0 overruns:0 frame:0 TX packets:83 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:39900 (38.9 KiB) TX bytes:11753 (11.4 KiB) eth0 Link encap:Ethernet HWaddr B7:23:EC:30:BE:B7 inet addr:169.254.199.229 Bcast:169.254.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:60265 errors:0 dropped:0 overruns:0 frame:0 TX packets:53413 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:52083764 (49.6 MiB) TX bytes:12746138 (12.1 MiB) eth1 Link encap:Ethernet HWaddr 10:6A:FD:32:07:7F inet addr:169.254.166.137 Bcast:169.254.255.255 Mask:255.255.0.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:52904 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:11527039 (10.9 MiB) TX bytes:53215987 (50.7 MiB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:200 errors:0 dropped:0 overruns:0 frame:0 TX packets:200 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:14428 (14.0 KiB) TX bytes:14428 (14.0 KiB)
这只是我不确定eth0和eth1收到随机IP地址的一部分。
连接设置：
Router -> (eth0)Server(eth1) -> Switch -> devices
服务器是我试图放弃所有数据包的地方。 但是连接到eth1的设备能够发送和接收所有stream量。 我的实际目标是将所有DNSstream量转发到本地DNS服务器。
通过桥梁的交通不（必然）通过netfilter。 检查net.bridge.bridge-nf-call-iptables sysctl的值; 如果它是0 ，那么这就是问题 – 将它设置为1 ，所有的都会很好。
在内核3.18或更高版本上，可能需要加载br_netfilter模块才能使上述sysctl可用。