Is it possible to enable port isolation on Linux bridges?

Question

On most managed switches you can enable Layer 2 Port Isolation. The implementation and terminology is different from vendor to vendor but generally speaking you keep one or more ports in the default Promiscuous (Cisco) or Uplink (HP) state and configure other ports as Isolated (Cisco) or Private (HP). Afterwards, isolated ports can only talk to promiscuous ones but not to each other.

Is there any way to implement this with Linux bridges to eg. isolate VMs from each other? Maybe via ebtables?

Answer 1

you can try using ebtables and create own rules involving input/output bridge port.

i dont have server with bridge at hand but i'd do something like this:

ebtables -P FORWARD DROP
ebtables -F FORWARD
ebtables -A FORWARD -i $uplinkPort -j ACCEPT # let the traffic flow from uplink to any ports
ebtables -A FORWARD -o $uplinkPort -j ACCEPT # let the traffic flow from any ports to uplink

Answer 2

As requested by @pQd here's a working example for port isolation with VMs (here: based on Proxmox VE) when the host is the uplink and all VMs should be isolated from each other. I use this for an internal service network (DNS, Updates, etc). The bridge is vmbr1, the virtual Ethernet devices are vethNNN.1 (where NNN is the VID). If you only want isolation, this should be enough:

ebtables --append FORWARD --logical-in vmbr1 --jump DROP

If multiple bridges are to be configured and other VMs should be Uplinks as well (here: veth100.1 and veth102.1), something like this is more appropriate (untested):

for br in $(seq 0 1); do
    br=vmbr$br
    ebtables --new-chain $br
    ebtables --policy $br DROP
    ebtables --append FORWARD --logical-in $br --jump $br
done
for if in 100.1 102.1; do
    br=vmbr$(echo $if | cut -d. -f2)
    if=veth$if
    ebtables --append $br --in-if $if
    ebtables --append $br --out-if $if
done

If the host shouldn't be an uplink, this should work (I didn't try it as well though):

ebtables --append INPUT --logical-in vmbr1 --jump vmbr1
ebtables --append OUTPUT --logical-out vmbr1 --jump vmbr1

Answer 3

This might be a simpler way to isolate VMs/other clients from each other, while still allowing them to communicate with the upstream gateway - using IP addresses (IPv4, here).

e.g., VMs are on 192.168.12.x/24, gateway is at 192.168.12.254. First 2 lines permit each direction to/from the gateway. Third line blocks all other IPv4 traffic between other hosts on the subnet:

ebtables -A FORWARD -p IPv4 --ip-src 192.168.12.0/24 --ip-dst 192.168.12.254 -j ACCEPT ebtables -A FORWARD -p IPv4 --ip-src 192.168.12.254 --ip-dst 192.168.12.0/24 -j ACCEPT ebtables -A FORWARD -p IPv4 --ip-src 192.168.12.0/24 --ip-dst 192.168.12.0/24 -j DROP

I haven't worked out how to also block "everything else" (non-ipv4 traffic) between these clients, because I expect you'd probably still need to allow some stuff through like ARP?