3

I have a linux host running 3.10 kernel with two bridged interfaces: eth0 & eth1 as brid00 with no IP.

Bridge works fine, but now I want to filter some of the traffic going through the bridge, but iptables' rules are not firing.

I have enabled net.bridge.bridge-nf-call-iptables (all traffic is IPv4) and net.ipv4.ip_forward and I'm using physdev module for matching.

For example, trying to block all ICMP requests with

iptables -A FORWARD -p icmp -m physdev --physdev-in eth0 --physdev-out eth1 -j DROP

has no effect. Any clue on whats happening? I think this kind of filtering was possible without using ebtables (My future plan is use nfqueue in some advanced filtering so I need iptables to fire the rules with the bridge traffic).

|improve this question
  • Tested on a machine running kernel 4.10 and the rules work fine, what am I missing? Any major change on how packets are routed between kernel 3.x and 4.x? – vktr Dec 10 '17 at 22:53
  • I'm really surprised if this worked on 4.10 with bridged traffic; to my knowledge, bridged traffic is all on L2, so the L3 iptables hooks are never called. Just use ebtables. – dirkt Dec 11 '17 at 7:56
  • 1
    It's an exception, if you enable the parameter net.bridge.bridge-nf-call-iptables, the traffic will call iptables. No way of making it work on kernel 3.10, looks like a bug because docs says it should. Works fine also in kernel 4.9 and 4.14. BTW, br_netfilter is a separated module in 4.x, you have to modprobe it to enable the functionality – vktr Dec 11 '17 at 17:36
  • Make that comment an answer? (You can answer your own questions). – dirkt Dec 11 '17 at 17:44
  • maybe because you are writing icmp instead of igmp ? – ibrahim Dec 12 '17 at 11:10
3

Considered a bug in kernel 3.10 (maybe only in my architecture, arm64). Works fine in 4.x kernels, tested in few of them. According to kernel diagrams and docs routing is the same between kernels 3.x & 4.x and should work in both, but it doesn't.

br_netfilter is a separate module in kernel 4.x, you have to modprobe br_netfilter to enable functionality.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.