Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I'd like to filter packets passing through a virtual bridge on a Fedora Linux machine. I've enabled the following sysctl options as described in multiple guides:

net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1

If one packet gets bridged from one port to another, I expect it to be passed throug the FORWARDING chain of the filter table of ip(6)tables, but this is not the case.

Is there something which has to be configured additionally?

Manuel

share|improve this question
I think they would appear on INPUT. FORWARDING means routing, but bridging is equivalent to "layer 2 routing" which is switching. – ultrasawblade Apr 22 '11 at 17:39
Unfortunately this is not the case either. – Manuel Faux Apr 22 '11 at 17:55
Shouldn't the physdev module of iptables be used when dealing with bridges ? – slubman May 6 '11 at 13:42

1 Answer

up vote 0 down vote

You're looking for the ebtables/brouting. It is part of the 2.6 kernel and can allow you to make layer 2 decisions based on layer 3 information.

http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html

I used this at a previous company to create a transparent ethernet bridge which would redirect (DNAT) specified packets to a local interface on the host.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.