I have a linux host running 3.10 kernel with two bridged interfaces: eth0 & eth1 as brid00 with no IP.
Bridge works fine, but now I want to filter some of the traffic going through the bridge, but iptables' rules are not firing.
I have enabled net.bridge.bridge-nf-call-iptables
(all traffic is IPv4) and net.ipv4.ip_forward
and I'm using physdev module for matching.
For example, trying to block all ICMP requests with
iptables -A FORWARD -p icmp -m physdev --physdev-in eth0 --physdev-out eth1 -j DROP
has no effect. Any clue on whats happening? I think this kind of filtering was possible without using ebtables (My future plan is use nfqueue in some advanced filtering so I need iptables to fire the rules with the bridge traffic).
ebtables
.