Contents
Why does BR-NF Pass Bridge traffic to iptables?
Since the traffic you are working is ip, iptables rules still apply because of br-nf passing the bridged packets to iptables. This is a great resource to read about the interaction and this one details the functionality of br-nf code, including how to disable all or some of the functionalities (i.e. not passing bridge traffic to iptables).
Which is responsible for filtering traffic on the Ethernet bridge?
As far as I understand iptables is only responsible for IP layer. ebtables should be responsible for filtering traffic on the ethernet bridge. So why do I have to add ACCEPT rule in iptable’s FORWARD chain? The br-nf code makes bridged IP frames/packets go through the iptables chains.
Why do I have to add accept rule in iptables forward chain?
When i do not add following rule the traffic is not passing through bridge. As far as I understand iptables is only responsible for IP layer. ebtables should be responsible for filtering traffic on the ethernet bridge. So why do I have to add ACCEPT rule in iptable’s FORWARD chain?
How does ebtables interact with iptables in Linux?
This document describes how iptables and ebtables filtering tables interact on a Linux-based bridge. Getting a bridging firewall on a 2.4.x kernel consists of patching the kernel source code. The 2.6 kernel contains the ebtables and br-nf code, so it doesn’t have to be patched.
Is there a way to block Facebook on iptables?
Quoting my iptables manual page about -m time: time This matches if the packet arrival time/date is within a given range. All options are optional, but are ANDed when specified. All times are interpreted as UTC by default. I suppose you are referring to this and that question when it comes to actually blocking Facebook.
Do you put an IP on the bridge?
Don’t put an IP on the bridge: put that IP on one end of a veth interface with its other end on the bridge: this should ensure that the bridge won’t interact with routing, but that’s not what are doing most container/VM common products.
Can a bridge be contacted from any interface?
The bridge has an IP address, and the machine can be contacted on that IP address from either interface. However, I don’t know what to configure to get traffic flowing across the bridge, between the interfaces.