3

I have three interfaces in a bridge like this

auto br0
iface br0 inet static
    bridge_ports enp0s10 wlx00e032800384 wlx08beac0a6c1d
    address 192.168.1.31
    netmask 255.255.255.0

An open AP is running on the third interface and for a start I want to block everything except 1 MAC address. I thought that this would do it (and limit anythig on that inteface to only being able to ssh to the AP box)

iptables -A INPUT -i wlx08beac0a6c1d -m mac ! --mac-source 00:30:65:05:9F:4D -j DROP
iptables -A INPUT -i wlx08beac0a6c1d -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o wlx08beac0a6c1d -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i wlx08beac0a6c1d -j DROP
iptables -A OUTPUT -o wlx08beac0a6c1d -j DROP

But it doesn't.

My guess is that the reason is because iptables only sees br0 and doesn't care about the individual interfaces? Is there a way of doing this?

I guess one way is to put the open AP on a different subnet and then somehow route between the two subnets?

1 Answer 1

4

Yes, with physdev:

physdev

This module matches on the bridge port input and output devices enslaved to a bridge device. This module is a part of the infrastructure that enables a transparent bridging IP firewall and is only useful for kernel versions above version 2.5.44.

[!] --physdev-in name
Name of a bridge port via which a packet is received (only for packets entering the INPUT, FORWARD and PREROUTING chains). If the interface name ends in a "+", then any interface which begins with this name will match. If the packet didn't arrive through a bridge device, this packet won't match this option, unless '!' is used.
[!] --physdev-out name
Name of a bridge port via which a packet is going to be sent (for bridged packets entering the FORWARD and POSTROUTING chains). If the interface name ends in a "+", then any interface which begins with this name will match.
[!] --physdev-is-in
Matches if the packet has entered through a bridge interface.
[!] --physdev-is-out
Matches if the packet will leave through a bridge interface.
[!] --physdev-is-bridged
Matches if the packet is being bridged and therefore is not being routed. This is only useful in the FORWARD and POSTROUTING chains.
2
  • Mostly right :) There seems to be a problem with physdev-out; the command iptables -A OUTPUT -m physdev --physdev-out wlx08beac0a6c1d -j DROP fails: iptables v1.8.2 (nf_tables): RULE_APPEND failed (Invalid argument): rule in chain OUTPUT. Nov 9, 2020 at 8:38
  • @RichardBarraclough You can only use --physdev-out in FORWARD and POSTROUTING, not in OUTPUT. Nov 9, 2020 at 14:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .