I'd like to be able to prevent a network bridge from generating certain types of traffic from some of its interfaces.

If I understand iptables correctly, packets generate by a device appear on the OUTPUT chain. I have tried adding a physdev match to the OUTPUT chain using iptables but get the following warning:

xt_physdev: using --physdev-out in the OUTPUT, FORWARD, and POSTROUTING chains for non-bridged traffic is not supported anymore.

From what I can tell, this capability was once added and then removed from iptables. Since many examples on the internet seem to no longer work.

Is someone able to comment on any of the following: what the original intention of this rule was, how we can use it correctly with more recent versions of iptables and how we can achieve the original intent of blocking traffic generated by the bridge from particular interfaces (I think the correct answer here might be ebtables).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.