8 port router over two switches (4+4)

Using kernel 2.6.x

I'm trying to setup private VLANs to enable port isolation on this router. Each physical Ethernet port should only be able to communicate with the eth0 interface (WAN) for Internet access.

Netfilter/iptables only sees the "br0" bridge interface, not the physical interface.

As a result, ebtables rules will be needed to unbridge the frames and perform dropping.

Each physical Ethernet port has its own private VLAN (i.e., eth1.1, eth1.2, etc.).

Robocfg will be used to assign private VLANs to physical ports. For example ...

robocfg vlan 10 "<port#> 8t"

How do you determine when a port should be tagged ?

1 Answer 1


You do not trust any of the (LAN) ports so the only tagged port should be the one of eth1.

It is not clear to be which interfaces are bridged and it may not matter for your case but iptables does see the bridge ports. Have a look at the physdev module.

  • Thank you. Did you mean the WAN port "eth0" (8t) ? Unfortunately, the Asuswrt kernel does not enable the physdev module, so ebtables would be used to unbridge and block packets at the port level.
    – uihdff
    Aug 17, 2017 at 9:49
  • 1
    No, the WAN interface does not send packets to the LAN ports, the LAN interface does. And there ist just one other device (which does not use VLANs) on the WAN port so tagging it would not make a difference. Just a security risk. Aug 17, 2017 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .