3

I am using a small Ubuntu 12.04 box as a Wi-Fi Access Point. The box has two interfaces which are bridged together as follows:

brctl addbr br0
brctl stp br0 off
brctl addif br0 wlan0
brctl addif br0 eth0

Everything is working great. However, I need to filter (and drop) packets based on source & destination IP address. According to this page:

http://ebtables.netfilter.org/br_fw_ia/br_fw_ia.html#section5

bridged packet do pass through the IP tables chains. But when I add a rule, it does not seem to work. For example:

iptables -I INPUT -s 192.168.1.23 -d 216.58.216.14 -j REJECT

I have tried this on the INPUT, OUTPUT, and FORWARD chains. I have also tried it with the --in-interface and --out-interface when possible. In those cases, I specified the bridge ports (wlan0 and eth0) rather than br0.

The kernel does have BRIDGE, NETFILTER, and MATCH_PHYSDEV enabled (as module support).

Is it possible to use iptables in this fashion? Is there a beter way to do this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.