iptables for bridge

The above rules are for a router based setup, i have a running bridge, br0, and i would like the traffic to pass through the above rules, the main aim is the filter. but the above do not seem to work, i am confused on INPUT, OUTPUT AND FORWARD.
If  you can change them to bridge enviroment, it would really help me get the bridge filter working. thanks.

iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix FLOOD: --log-level 7

# Limit the number of incoming tcp connections
iptables -N syn_flood
iptables -A INPUT -p tcp --syn -j syn_flood
iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A syn_flood -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix SYN-FLOOD: --log-level 7
iptables -A syn_flood -j DROP

You must have recent enough (or patched) kernel to support br-nf. For kernels > 2.6.1 you should set:
echo 1 >  /proc/sys/net/bridge/bridge-nf-call-iptables
(http://ebtables.sourceforge.net/documentation/bridge-nf.html)

This enables passing bridged packets to iptables chains.

For further information see also:
http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html
http://tldp.org/HOWTO/Ethernet-Bridge-netfilter-HOWTO.html

thanks for the reply.
but i do not want to use ebtables, i just want to use iptables. and am using centos 5.3 2.6.18-128 kernel. Do i still need br fw ?

Do you have the settings file /proc/sys/net/bridge/bridge-nf-call-iptables ? What does it contain:
cat /proc/sys/net/bridge/bridge-nf-call-iptables
If it is 0 you can set it to 1 with:
echo 1> /proc/sys/net/bridge/bridge-nf-call-iptables

After this you should see the traffic in iptables FORWARD chain. The links I posted also explain this - they are not only on ebtables.

unfortunately no, the Centos 5 does not have that /proc/sys/net/bridge directory at all. is there a way i can install bridge-nf ? if not then can you recommand me version which has these built in, i do not want to get into compiling  !

thanks

OK, what about the output of command:
/sbin/sysctl -a | grep net.bridge

net.bridge.bridge-nf-filter-vlan-tagged = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1

I have put the rules, and they seem to work as they log the packets. but strange thing is that even when 1 pc is connected behind this bridge, triggers the syn flood rule, while i am just browsing cnn.com website.  are the rules above very agressive ?

many thanks for the help

Yes, the above rules are VERY aggressive. There are several (a couple of ten) syn connections created for a single web page and the rule is limiting to 1 connection per second...

Maybe the rules should be split for web traffic and other traffic:
iptables -A syn_flood -p tcp --dport 80 -m limit --limit 30/s --limit-burst 500 -j RETURN
iptables -A syn_flood -p tcp --dport 443 -m limit --limit 30/s --limit-burst 500 -j RETURN
iptables -A syn_flood -m limit --limit 1/s --limit-burst 20 -j RETURN