I have a scheme like this






and connected eth0 and eth1 like this to allow packets pass through brctl addbr br0 brctl addif br0 eth0 brctl addif br0 eth1 dhclient br0

and the user can ping to router directly but I want to block that pinging

I tried even

iptables -A OUTPUT -p icmp --icmp-type echo-request -j DROP

iptables -A FORWARD -p icmp --icmp-type echo-request -j DROP

and user still can ping to router, what am i doing wrong?

  • Please show us your iptables -nvL with the non-working rule so we can actually see if there's any error in it. It would also be nice to know if you can ping the router from that server. – Julie Pelletier Dec 11 '16 at 4:44
  • there is no more iptables that is all I want to do – Zenoheld Dec 11 '16 at 5:03
  • I'm not sure what your point is but you will not get any useful answer if you refuse to provide the details that could clarify your mistake. – Julie Pelletier Dec 11 '16 at 6:45

A bridge is to connect two interfaces that are in the same subnet.

If you have different subnets and want them to communicate with each other, you need to enable routing echo 1 > /proc/sys/net/ipv4/ip_forward but by default this is not enabled, so they will not be able to talk to each other.

Edit: Bridging two interfaces in different subnets will work but it's not a traditional setup. If you want to keep your configuration that way, you'll have to use ebtables instead of iptables to block the traffic.

  • I tried to use ebtables but when I use them the router suddenly dies and computer are not able to communicate each other until I restart it – Zenoheld Dec 18 '16 at 1:03

You should define your iptables with router ip address.Any users cant ping router ip address.Your example was general iptables rules.Dropping icmp protocol was right to prevent ping.

  • mmm how should I drop icmp protocol? I did a iptables -A INPUT --p icmp --icmp-type echo-request -j DROP. – Zenoheld Dec 18 '16 at 1:04
  • Its correct iptables rule.Why did you ask again? If you are not sure.You can search it from Internet. – supriady Dec 18 '16 at 3:16
  • because they do not work.. – Zenoheld Dec 18 '16 at 3:38
  • you should use your router ip address on iptables rule not used general iptables rule.You meant to drop all ping to your router ip address.Why dont you read some iptables tutorial? – supriady Dec 18 '16 at 3:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.