1

I've Ubuntu 20.04 LTS for Raspberry PI and I've created a wireless access point using the snapon wifi-ap package. That allows hosts to attach to a 192.168.8 network and works beautifully the Ubuntu servers default route on the eth0 interface to the local router 192.168.0.1 permits them internet access.

However I would like to isolate the hosts from each other but still allow them accesss to the internet. But I've no experience with creating iptables/ebtables etc. in a Bridged network.

Thus my question is how to filter a network bridges traffic to DROP packets to other hosts in the same bridge but allow other network activity.

2
  • You need to set up a firewall on each of the hosts on the bridge to control access to the machine. There's no way to prevent on-link traversal between machines on a 'bridge' - it behaves the same way as a network subnet segment, things are sent directly to the link and don't pass through the 'gateway', so unless you set up firewalls on the individual hosts sitting on that 192.168.8 network segment you can't isolate them easily from each other.
    – Thomas Ward
    Mar 10, 2021 at 16:50
  • I don't have access to the machines which are connecting to the wifi.. So the 'filtering' will need to be done in the bridge. Mar 10, 2021 at 16:56

1 Answer 1

0

One way I've discovered of allowing it..

The following ebtables command seems to do the job.. hosts within the bridge can still access outside of the bridge but not each other.

ebtables -A FORWARD --logical-in br0 -j DROP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .