Thomas Zeitlhofer wrote:
> I have set up a bridge with two ports:
> 
> # brctl show br0
> bridge name     bridge id               STP enabled     interfaces
> br0             8000.000021f23d58       no              eth1
>                                                         tap1
> 
> Using 2.6.16/.1 non fragmented IP packets are passing the bridge without
> problems, but fragmented IP packets do not show up on the outgoing
> interface. E.g., for fragmented traffic coming in from tap1 and going
> out via eth1 tcpdump shows:
> 
>   1) on tap1: fragmented packets
>   2) on br0: the defragmented packet (connection tracking)
>   3) on eth1: no packet!?
> 
> This breaks IPsec connections for example.
> 
> 
> Doing the same on 2.6.15.x shows:
> 
>   1) on tap1: fragmented packets
>   2) on br0: the defragmented packet (connection tracking)
>   3) on eth1: fragmented packets

Are you sure this is correct? I think in 2.6.15 you should see
the fragments on br0 already.

Anyway, since 2.6.16 ip_conntrack doesn't do refragmentation anymore
but relies on fragmentation in the IP layer. Purely bridged packets
don't go through the IP layer, so the bridge netfilter code needs to
take care of fragmentation itself. Please try if this patch helps.

> and IPsec connections are ok.

This is probably a different issue. Please describe your setup
(IPsec, NAT and filtering).