I want to configure outside and inside forwarding rules to behave the same way, and simplified problem that i have with 'inside part' is like this:if i havecompA - eth0 192.168.0.1compB - br0  192.168.0.2        +eth0compC - eth0 192.168.0.3     ...running appache on port80 with simple it works pageis it possible to make tcp tunnel in compB, that will forward port 80 from A to C.When there is NO bridge (compB - eth0  192.168.0.2) enough commands are:compB# iptables -t nat -A PREROUTING  -d 192.168.0.2 -p tcp --dport 80 -j DNAT --to-destination 192.168.0 3compB# iptables -t nat -A POSTROUTING -d 192.168.0.3 -p tcp --dport 80 -j MASQUERADEbut after adding BRIDGE with commands:compB# brctl addbr br0; brctl addif br0 eth0compB# ip addr del 192.168.0.2/24 dev eth0compB# ip addr add 192.168.0.2/24 dev br0compB# ip route del default; ip route add default 192.168.0.2/24 dev br0compB# ip link set dev br0 onpackets from compA do not reach compC anymore. Testing with:compA# echo -en GET / HTTP/1.0\r\n\r\n | nc 192.168.0.2 80... which should return root http page of compC (working ok without bridge involved).UPDATE: SOLUTION1: echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptablesafter disabling bridge hooks for iptables situation is OK again.But I still looking for 'iptables commands combination' solution that will work with bridge configured standard way.SOLUTION2:ip link set dev br0 promisc onworks too, but will impact global performances.SOLUTION3: ebtables -t broute -A BROUTING -p ipv4 --ip-proto tcp --ip-dport 143 -j redirect --redirect-target DROPebtables -t broute -A BROUTING -p ipv4 --ip-proto tcp --ip-dport  80 -j redirect --redirect-target DROPebtables -t broute -A BROUTING -p ipv4 --ip-proto tcp --ip-sport  80 -j redirect --redirect-target DROP... seems ok, info found here and here.
tcp tunnel inside local network with iptables and bridge involved
iptables;ip;port forwarding