Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

At home I have tomato usb installed on my Asus RT-N16, i want to block all traffic from host let's say to host both hosts are inside local lan network.

how do i do that with iptables?

i've tried

iptables -I INPUT -i br0 -o br0 -d -s -j DROP

but it's not working

share|improve this question
up vote 2 down vote accepted

Both hosts would appear to be in the same subnet in your example (as I'm assuming a /24 subnet). Without using a layer 2 filtering mechanism (like ebtables) you're not going to be able to filter that traffic.

Hosts in the same subnet communicate to each other at layer 2 w/o needing a router to facilitate the communication. Because the router isn't involved your iptables rules aren't going to affect the traffic.

share|improve this answer
are you sure about this answer.? – l--''''''---------'''''''''''' Jul 27 '11 at 16:22
If those hosts are in the same subnet they won't be using the routing functions of the Linux instance running on the router to communicate with each other. They might be talking thru the bridging code in Linux, but the rule in the post won't do anything to bridged traffic. – Evan Anderson Jul 27 '11 at 17:20
during my experiments i've managed to block traffic using iptables -t mangle -I POSTROUTING -d -j DROP, but it blocks all traffic to this host, even if i specify -s, so it's not working on specific host – Troydm Jul 28 '11 at 6:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.