Careful with the term "share their internet", usually this involves some kind of NAT (network address translation). I'll assume this is not the case for your setup.
You mention a DNS proxy with 172.16.248.254, but it's not clear how it is connected to the network. I'll assume a network diagram like this (please correct if my interpretation is wrong):
What xx-tables is the best to filter (limit, not drop) ARP packets?
iptables starts from IP layer: it's already too late to handle ARP.
While specialized in ARP, arptables lacks the necessary matches and/or targets to limit rather than just drop ARP packets. It can't be used for your purpose.
ebtables can be a candidate (it ...
1) From fwknop documentation:
The fwknop project supports four different firewalls: iptables,
firewalld, PF, and ipfw across Linux, OpenBSD, FreeBSD, and Mac OS X.
There is also support for custom scripts so that fwknop can be made to
support other infrastructure such as ipset or nftables.
So clearly, it officially supports 4 firewalls only. But ...
I'm not suggesting this is the best option, but if you can't find another that works then you could "roll your own" using a downloadable GeoIP database and the ipset tool.
For example download the Geolite2 database Countries in CSV format. Download and unzip the files:
(I admit I don't understand all the switch settings but that's not relevant to the question.)
Your current rule, in filter/INPUT prevents packets from eth1.10 to reach router's owned IPs other than 192.168.10.0/28, so it indeed has the intended effect of not allowing IPs coming from eth1.10 to access 192.168.1.1.
Why is it needed?
That's because a Linux ...
Proxybound can do the job
To apply it system widely as you asked you can ad it as a default preloaded library, to do so edit /etc/ld.so.preload and add /usr/local/lib/libproxybound.so or libproxybound.so depending on how you installed proxybound
After reboot any started application will be preloading proxybound and thus proxified
This method need to be ...
A total of 2500 rules would be a big effort for the CPU/bandwidth in case of affecting each package. If, for example, you send 10000 packages you would be analyzing 25.000.000 rules, that would suppose a lot of work. It would be a lot of more accurate and secure to block all the incoming traffic (except the established and the related), and then start ...