How do packets traverse tc/netfilter physical, VLAN and bridge interfaces?

Question

Given the following setup on a router that performs NAT between two networks A and B:

eth0 - physical interface - no ip address
- eth0.1 - VLAN interface for network A - no ip address
- eth0.2 - VLAN interface for network B - ip address for network B
br0 - bridge - ip address for network A
- combines eth0.1 with other (irrelevant) interfaces

Question

A packet arrives from network A, so it is tagged with VLAN ID 1. Physically, it is received by eth0. Logically by eth0.1 but also by br0.

If the destination IP is in network B then it will additionally be forwarded logically to eth0.2 but has to leave physically through eth0 again.

In what order are such packets processed by ingress/egress qdiscs and PRE/POSTROUTING iptables?

What about the other direction, from network B to A through the same interfaces?

See netfiler packet flow diagram for reference:

xnor · Accepted Answer · 2017-03-21 21:17:51Z

2

After some experiments with tcpdump and iptables I've observed the following:

If a packet sent from network A to network B then tcpdump shows :

Iptables:

I assume qdiscs are processed in an order like this:

answered Mar 21, 2017 at 18:59

xnor

1611 silver badge5 bronze badges