Hello,
I need to block all traffic that may arrive from the "master interface"
of some, but not all, bridges. This is mainly to prevent ARP packets
from reaching the network stack, but I would prefer to drop everything
to be certain, rather than just ARPs.
This works:
table bridge brtable {
chain inp {
type filter hook input priority 300; policy accept;
log prefix "INP-" drop
}
}
but it works for _all_ bridges. I would like to decide if packet must be
dropped or not based on the instance of the bridge, like so:
table bridge brtable {
set to_drop {
typeof oif
elements = { "br5", "br6" }
}
chain inp {
type filter hook input priority 400; policy accept;
oif @to_drop drop
}
}
but that does not work. Indeed in the log, the output interface is
empty. Iif is not empty, and filtering by iif would probably work, but
it would be much more convenient to filter by the bridge instance than
to keep track of all interfaces that were enslaved into it.
Any suggestions?
Thank you,
Eugene
Attachment:
OpenPGP_signature
Description: OpenPGP digital signature
