Some more information about how the system’s configure, ebtables and iptables are used for L2/L3 filtering. A virtual IP. (192.168.1.1) has a multicast MAC paired with it (03:11:11:11:11:11). Although the Ethernet MAC is multicast, it’s not being forwarded to all virtual interface on the network. Interfaces on the system is the bridge interface (br0) and multiple virtual interface for the guest (vnet0, vnet1, vnet2, etc.).
ARP, NLB and various other broadcast traffic is getting through to all virtual interfaces, so it just this IP with the multicast Ethernet address that’s having issues. After analysing the traffic again, I noticed that the ICMP request does arrive at the bridge interface but it doesn’t not get forwarded to the virtual interface. ebtables has been configured to filter by bridging, so it should be forwarding packets to the virtual interfaces based on MAC multicasting.
However, I just noticed that arp table has cached an entry for the virtual IP to br0 itself. This might be the cause of the problem. Will try a few a things to see if I can fix the problem.
In the meantime, any suggestions will be greatly appreciated. Thank you.