Warm tip: This article is reproduced from serverfault.com, please click
linux ubuntu iptables bridge

Iptables

发布于 2021-01-13 23:11:53

I have setup ethernet bridge br0 that contains two interfaces eth0 and tap0

brctl addbr br0
brctl addif eth0
brctl addif tap0
ifconfig eth0 0.0.0.0 promisc up
ifconfig tap0 0.0.0.0 promisc up
ifconfig br0 10.0.1.1 netmask 255.255.255.0 broadcast 10.0.1.255

My default FORWARD chain policy is DROP

iptables -P FORWARD DROP

When i do not add following rule the traffic is not passing through bridge. 

iptables -A FORWARD -p all -i br0 -j ACCEPT

As far as I understand iptables is only responsible for IP layer.

ebtables should be responsible for filtering traffic on the ethernet bridge.

So why do I have to add ACCEPT rule in iptable's FORWARD chain?

Questioner
Dariusz Bacinski
Viewed
11
分享
coredump 2010-07-21 05:10:39

Because of the br-nf code that is available as a patch to linux 2.4 and used in linux 2.6:

The br-nf code makes bridged IP frames/packets go through the iptables chains. Ebtables filters on the Ethernet layer, while iptables only filters IP packets.

Since the traffic you are working is ip, iptables rules still apply because of br-nf passing the bridged packets to iptables.

This is a great resource to read about the interaction and this one details the functionality of br-nf code, including how to disable all or some of the functionalities (i.e. not passing bridge traffic to iptables).

Arie Skliarouk 1970-01-01 08:00:00

The functionality is not working on 4.4.0-22-generic (ubuntu 16.04), even after I did echo "1" > /sys/devices/virtual/net/br0/bridge/nf_call_arptables. Any ideas?

Arie Skliarouk 1970-01-01 08:00:00

Answering myself: # Load br_netfilter modprobe br_netfilter # Add to BROUTING chain rule to forward all ipv4 packets to iptables ebtables -t broute -A BROUTING -p ipv4 -i br0 -j DROP

热门帖子

1
推荐一些好玩的/大众的手游
2
求指教后端项目迁移方案
3
迷你洗衣机是不是都是智商税？
4
求助一个排查了半年没解决的 MySQL order by 子句导致索引失效的问题， 500 多万条记录的小表要查快两分钟
5
个人开发了一款 WordPress 主题： iPao，集成了 AI 总结功能
6
偶然发现奇游加速器会在系统里植入根证书
7
国内有蒲公英替代品推荐吗？
8
语音助手这个东西真的会监听谈话并且上传，从而泄漏隐私吗？
9
出一些有意思的域名-明盘
10
jetbrains 全家桶升级 2024 后，在滚动代码时候感觉有点掉帧

热门github

1
Implementation of paper - YOLOv9: Learning What You Want to Learn Using Programmable Gradient Information
2
A Windows and Office activator using HWID / Ohook / KMS38 / Online KMS activation methods, with a focus on open-source code and fewer antivirus detections.
3
Get up and running with Llama 2, Mistral, Gemma, and other large language models.
4
该项目可以让你通过订阅的方式使用Cloudflare WARP+，自动获取流量。This project enables you to use Cloudflare WARP+ through subscription, automatically acquiring traffic.
5
Multi functional app to find duplicates, empty folders, similar images etc.
6
Xray panel supporting multi-protocol multi-user expire day & traffic & ip limit (Vmess & Vless & Trojan & ShadowSocks & Wireguard)
7
The Free Software Media System
8
lightweight, standalone C++ inference engine for Google's Gemma models.
9
📚 Freely available programming books
10
A collective list of free APIs
11
1️⃣🐝🏎️ The One Billion Row Challenge -- A fun exploration of how quickly 1B rows from a text file can be aggregated with Java
12
🎓 Path to a free self-taught education in Computer Science!
13
Curso para aprender el lenguaje de programación Python desde cero y para principiantes. 75 clases, 37 horas en vídeo, código, proyectos y grupo de chat. Fundamentos, frontend, backend, testing, IA...
14
This repository contains System Design resources which are useful while preparing for interviews and learning Distributed Systems
15
Mamba is a new state space model architecture showing promising performance on information-dense data such as language modeling, where previous subquadratic models fall short of Transformers. It is based on the line of progress on structured state space models, with an efficient hardware-aware design and implementation in the spirit of FlashAttention.