Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to filter packets passing through a virtual bridge on a Fedora Linux machine. I've enabled the following sysctl options as described in multiple guides:

net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1

If one packet gets bridged from one port to another, I expect it to be passed throug the FORWARDING chain of the filter table of ip(6)tables, but this is not the case.

Is there something which has to be configured additionally?


share|improve this question
I think they would appear on INPUT. FORWARDING means routing, but bridging is equivalent to "layer 2 routing" which is switching. – LawrenceC Apr 22 '11 at 17:39
Unfortunately this is not the case either. – Manuel Faux Apr 22 '11 at 17:55
Shouldn't the physdev module of iptables be used when dealing with bridges ? – slubman May 6 '11 at 13:42

You're looking for the ebtables/brouting. It is part of the 2.6 kernel and can allow you to make layer 2 decisions based on layer 3 information.

I used this at a previous company to create a transparent ethernet bridge which would redirect (DNAT) specified packets to a local interface on the host.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.