I am using a small Ubuntu 12.04 box as a Wi-Fi Access Point. The box has two interfaces which are bridged together as follows:
brctl addbr br0 brctl stp br0 off brctl addif br0 wlan0 brctl addif br0 eth0
Everything is working great. However, I need to filter (and drop) packets based on source & destination IP address. According to this page:
bridged packet do pass through the IP tables chains. But when I add a rule, it does not seem to work. For example:
iptables -I INPUT -s 192.168.1.23 -d 184.108.40.206 -j REJECT
I have tried this on the INPUT, OUTPUT, and FORWARD chains. I have also tried it with the --in-interface and --out-interface when possible. In those cases, I specified the bridge ports (wlan0 and eth0) rather than br0.
The kernel does have BRIDGE, NETFILTER, and MATCH_PHYSDEV enabled (as module support).
Is it possible to use iptables in this fashion? Is there a beter way to do this?