Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a tap bridge between 2 local networks. It work great except that clients from the 'other' network can use dhcp server and most important can use wan gateway of the second network which is bad. It couldn't be done just by blocking ip's cause everyone can set static ip. I'm quessing it could be done by blocking some interfaces traffic but I'm really not an expert.

tap0 is bridged with lan and wlan as br-lan

share|improve this question

1 Answer 1

It would be easier to place the VPN in a non-bridged mode, with a separate sub-net. I try to use a separate sub-net for each security zone. This helps address problems like you are encountering. The tradeoff is increased routing complexity versus simpler security setup.

I am not sure of the iptables syntax that will result as I don't use bridged mode in my network. But you should be able to specify the tap interfaces in your rule set.

If you are running on you may want to look at the Shorewall and Bridged Firewalls documentation.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.