This rule fails on recent kernels because of bogus mask
check added in kernel commit
8df772afc9d0 ("netfilter: x_physdev: reject empty or not-nul terminated device names").
Signed-off-by: Florian Westphal <fw@strlen.de>
:INPUT,FORWARD
-m physdev --physdev-in lo;=;OK
-m physdev --physdev-is-in --physdev-in lo;=;OK
+-m physdev --physdev-is-in --physdev-in 1234567890abcde;=;OK
:OUTPUT,FORWARD
# xt_physdev: using --physdev-out in the OUTPUT, FORWARD and POSTROUTING chains for non-bridged traffic is not supported anymore.
# ERROR: should fail: iptables -A FORWARD -m physdev --physdev-out lo