Are there tools to define in Linux something similar to Policy-based Routing, but on Layer2 level? Usual Linux bridge uses destination MAC to decide, which interface to send frame to. Can this behavior be altered?

Let's say we have a machine with several interfaces - physical, virtual, VLAN-tagged subinterfaces, etc. A frame arrives at one of them. Can we decide, which outgoing interface the frame will be delivered to, according to parameters such as VLAN tag in the frame, source MAC address, source interface, 802.1p priority, etc.?

  • Have a look to openvswitch.org, it's an advanced bridge for Linux. I'm not sure if you can do that with it, but it worth a try. Mar 13, 2013 at 12:33

1 Answer 1


Sounds like you are looking for ebtables

The ebtables program is a filtering tool for a Linux-based bridging firewall. It enables transparent filtering of network traffic passing through a Linux bridge. The filtering possibilities are limited to link layer filtering and some basic filtering on higher network layers. Advanced logging, MAC DNAT/SNAT and brouter facilities are also included.

The ebtables tool can be combined with the other Linux filtering tools (iptables, ip6tables and arptables) to make a bridging firewall that is also capable of filtering these higher network layers. This is enabled through the bridge-netfilter architecture which is a part of the standard Linux kernel.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.