From a7e44b44dc5b1747186174bc1fc31aa194d8800d Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Wed, 3 Sep 2014 19:09:52 +0100 Subject: [PATCH] match on bridge name in iptable masquerade rules Instead of ip/netmask. This should be functionally equivalent (for now), and makes it easier to identify the rule as belonging to weave. Unfortunatley we must still match the source with ip/netmask, since we are in the POSTROUTING chain and source interface matches aren't valid there. See also issue #20. --- weaver/weave | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/weaver/weave b/weaver/weave index 7979e0de..202b650b 100755 --- a/weaver/weave +++ b/weaver/weave @@ -49,8 +49,8 @@ add_nat_rule() { } setup_masquerading() { - add_nat_rule "POSTROUTING -d $IPADDR ! -s $IPADDR -j MASQUERADE" - add_nat_rule "POSTROUTING -s $IPADDR ! -d $IPADDR -j MASQUERADE" + add_nat_rule "POSTROUTING -o $BRIDGE ! -s $IPADDR -j MASQUERADE" + add_nat_rule "POSTROUTING -s $IPADDR ! -o $BRIDGE -j MASQUERADE" } case "$COMMAND" in