Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need some assistance to create a set of iptable rules to route and restrict usage between interfaces in a bridge (br0).

# brctl show
bridge name bridge id               STP enabled     interfaces
br0           8000.002590387da2     no              eth0
                                                    vnet0
                                                    vnet1

I have enabled net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables (for a description of what i need, see: Firewall on a KVM host, prevent access to VM:s).

I'm not skilled at iptables hacking and need some help, or a point in the right direction. Right now I'm not even sure in what table/chain I'm suppose to work against.

share|improve this question
    
I have a working solution, I will update this question (when I have time), or should a answer be more appropriate? –  nsg Jul 12 '11 at 13:00
add comment

2 Answers 2

You should probably read this to get an idea of which rules need to go where. This picture (copied from the Ubuntu wiki) provides a simple yet good overview of how traffic flows through iptables:

enter image description here

share|improve this answer
    
Yes, I will give the link a try. Thank you for the picture. –  nsg Jul 4 '11 at 16:10
add comment

The Shorewall article on Bridged Firewalls may help.

share|improve this answer
    
Thank you, I will read this tomorrow. –  nsg Jul 4 '11 at 16:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.