Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a tap bridge between 2 local networks. It work great except that clients from the 'other' network can use dhcp server and most important can use wan gateway of the second network which is bad. It couldn't be done just by blocking ip's cause everyone can set static ip. I'm quessing it could be done by blocking some interfaces traffic but I'm really not an expert.

tap0 is bridged with lan and wlan as br-lan

share|improve this question

It would be easier to place the VPN in a non-bridged mode, with a separate sub-net. I try to use a separate sub-net for each security zone. This helps address problems like you are encountering. The tradeoff is increased routing complexity versus simpler security setup.

I am not sure of the iptables syntax that will result as I don't use bridged mode in my network. But you should be able to specify the tap interfaces in your rule set.

If you are running on you may want to look at the Shorewall and Bridged Firewalls documentation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.