iptables and controlling traffic between hosts on subnet

Question

recently I installed OpenWrt on a TP-LINK router. Now I would like to control the traffic between certain hosts on the same subnet. As iptables is available on OpenWrt based routers, I thought this should be a trivial task. I am using OpenWrt Chaos Calmer 15.05.1.

In my first attempt I simply wanted to add a new rule to Network/Firewall/Traffic Rules. For example, I want to prevent host A from talking to host B based on the MAC address of host A and the IP of host B:

Any traffic
From any host in lan with source MAC AA:AA:AA:AA:AA:AA (host A)
To IP W.X.Y.Z in lan (host B)
Discard forward

This rule has been set up using OpenWrts' built in Wizard. Due to the fact that this section is called "traffic rules", I thought that OpenWrts takes care of adding/inserting the rule correctly. However, host A is still able to talk to host B.

In my next attempt, I manually added an iptables rule to the "custom rules" section, which are loaded right after the default rules:

iptables -A FORWARD -p ALL -m mac --mac-source AA:AA:AA:AA:AA:AA -d W.X.Y.Z -j DROP

So far I have not been able to get this to work. Any thoughts on this? Additionally, can anybody point me to a solution where host B will still be able to talk to host A? My approach (if working) would shut down any communication.

Thanks

Answer 1

You will have to put host A and host B on different subnets with the router between them. If they are on the same subnet, they talk directly to each other and the router does not even see the IP packets they are exchanging. To be more precise, when I say "directly", I mean they talk to each other on Layer 2 (Data Link), and the ethernet frames may or may not go through the TP-LINK, but it acts as a Layer 2 switch.