Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have my server set up with several public IP addresses, with a network configuration as follows (with example IPs):

 \- br0 -
     |- [VM 1's eth0]
     |    |-
     |    \-
     \- [VM 2's eth0]

My question is, how do I set up iptables with different rules for the actual physical server as well as the VMs? I don't mind having the VMs doing their own iptables, but I'd like br0 to have a different set of rules. Right now I can only let everything through, which is not the desired behavior (as br0 is exposed).


share|improve this question
up vote 3 down vote accepted

Since you have assigned an IP address to br0, it effectively is the "real" network interface for your server. You can create iptables rules on your server that work equally well regardless of whether your network interface is named br0 or eth0. That is, just write your server's firewall iptables rules as though your network interface was a plain vanilla eth0 (except that it's named br0).

Don't worry about having to write your iptables rules to explicitly allow traffic to the virtual interfaces joined to bridge br0, because (and this is a key point) iptables rules cannot explicitly filter or affect traffic on the bridge. The reason is that bridges operate at the link layer (L2), and iptables operates (for the most part) on packets at higher network layers (typically L3 and L4). A mental picture that might be helpful is this: A bridge functions almost exactly like a network hub with all the bridged interfaces plugged into it.

If you want to filter traffic passing through a bridge, you should look into ebtables, but it is unlikely that you will need to. It is much more natural and convenient to simply treat the bridge as part of the networking infrastructure (i.e. like a hub or a switch), and to create an iptables firewall script for each host (whether real or VM) on the network.

share|improve this answer
Okay, my problem was that I was trying to use the physical interface (eth0) in iptables instead of the bridge (br0). That fixed it. Thanks! – Andrew Koester Jan 24 '11 at 14:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.