At home (192.168.x.x) with various routers and servers, I have set up an WiFI AP using eth0<->wlan0 sharing, as Guest WiFi.

-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -j ACCEPT

Clients that connect to wlan0 should have internet access but all other traffic from and to any other address on 192.168.x.x should be dropped. How can I specify this in iptables?


That's what the physdev module is for:

-A FORWARD -m physdev --physdev-in wlan0 --physdev-out eth0 -j ACCEPT

  • could you elaborate a bit more please?
    – ECII
    Aug 5 '17 at 12:01
  • 1
    @ECII What shall I explain about that? -i and -o do not work with bridged interfaces thus you need physdev; simple as that. man iptables-extensions Aug 5 '17 at 12:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.