Home / server / Questions / 262596
In Process
Manuel Faux
Asked: 2011-04-23 09:32:05 +0800 CST

iptables packetfilter on virtual bridge

  • 772

I'd like to filter packets passing through a virtual bridge on a Fedora Linux machine. I've enabled the following sysctl options as described in multiple guides:

net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1

If one packet gets bridged from one port to another, I expect it to be passed throug the FORWARDING chain of the filter table of ip(6)tables, but this is not the case.

Is there something which has to be configured additionally?

Manuel

virtualization firewall switch iptables

1 Answers

  1. You're looking for the ebtables/brouting. It is part of the 2.6 kernel and can allow you to make layer 2 decisions based on layer 3 information.

    http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html

    I used this at a previous company to create a transparent ethernet bridge which would redirect (DNAT) specified packets to a local interface on the host.

    • 0