# FIPS: bridge netfilter settings
#
# kmod-br-netfilter must be loaded for AF_PACKET sockets to receive frames
# on bridge member ports (e.g. eth1 when it is a member of br-lan).
# Without it, the bridge's rx_handler intercepts frames before they reach
# the packet socket layer.
#
# We load br_netfilter for the AF_PACKET visibility benefit but disable its
# IP/IPv6/ARP call hooks to avoid double-processing of routed traffic.
net.bridge.bridge-nf-call-iptables=0
net.bridge.bridge-nf-call-ip6tables=0
net.bridge.bridge-nf-call-arptables=0
