Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need some assistance to create a set of iptable rules to route and restrict usage between interfaces in a bridge (br0).

# brctl show
bridge name bridge id               STP enabled     interfaces
br0           8000.002590387da2     no              eth0

I have enabled net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables (for a description of what i need, see: Firewall on a KVM host, prevent access to VM:s).

I'm not skilled at iptables hacking and need some help, or a point in the right direction. Right now I'm not even sure in what table/chain I'm suppose to work against.

share|improve this question
I have a working solution, I will update this question (when I have time), or should a answer be more appropriate? – nsg Jul 12 '11 at 13:00

You should probably read this to get an idea of which rules need to go where. This picture (copied from the Ubuntu wiki) provides a simple yet good overview of how traffic flows through iptables:

enter image description here

share|improve this answer
Yes, I will give the link a try. Thank you for the picture. – nsg Jul 4 '11 at 16:10

The Shorewall article on Bridged Firewalls may help.

share|improve this answer
Thank you, I will read this tomorrow. – nsg Jul 4 '11 at 16:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.