problems filtering with ip tables over bridge

Gone_Crazy · 07-13-2006, 10:29 AM

Hi guys n gals,

I'm having a bit of a problem with setting firewall rules using iptables over a bridge on Debian Sarge.

Current configuration is:

ADSL Router: 192.168.1.1 connecting on eth0 to
Debian br0 : 192.168.1.5 connecting on eth1 to

Windoze PC : 192.168.1.20 (Default gateway set to 192.168.1.1)

I can edit the iptables to deny all access to/from the Debian server/firewall and this stops all traffic being sent and received on that unit, but the Win PC still has access through to its default gateway on all port and all protocols.

Obviously, if I bring the bridge down then the Win PC loses its connectivity but I'm struggling to restrict access to/from the Win PC.

I've read some documents on ebtables, which sounds relative but I've not been able to make sense of them.

Not sure if I'm overlooking something blatantly simple here but any help and/or advice you can offer is greatly appreciated.

peter_robb · 07-14-2006, 04:04 PM

Please pop in the output from route -n on the Debian box..

It's not too clear where the bridge connection is working..

Gone_Crazy · 07-15-2006, 04:54 AM

The bridge is setup across the 2 eth interfaces (eth0 to router, eth1 to win PC)

Routing table:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 br0

brctl show output:

bridge name bridge id STP enabled interfaces
br0 8000.0040f438266c no eth0
eth1