Yrurtj

I am struggling to create a bridge firewall with iptables since I cannot find/catch packets flowing through a bridge with two interfaces in centos7. No ip addresses are configured on interfaces or the bridge. I cannot seem to find this traffic, checked PREROUTING INPUT FORWARD OUTPUT POSTROUTING chains. Although ifconfig counters shows that traffic is flowing through bridged interfaces but not the bridge(br0) itself.

My bridge config

# cat ifcfg-br0

DEVICE=br0

TYPE=Bridge

BOOTPROTO=none

IPADDR=0.0.0.0

PREFIX=24

IPV6_AUTOCONF=no

IPV6INIT=no

ONBOOT=yes

DELAY=0`

OUTWARDS interface

# cat ifcfg-p1p

DEVICE=p1p1

TYPE=Ethernet

HWADDR=XX:XX:XX:XX:XX:XX

ONBOOT=yes

BRIDGE=br0

BOOTPROTO=none

IPV6INIT=no

IPV6_AUTOCONF=no

IPADDR=0.0.0.0

PREFIX=24`

INWARDS interface

# cat ifcfg-p1p2

DEVICE=p1p2

TYPE=Ethernet

HWADDR=XX:XX:XX:XX:XX:XX

BOOTPROTO=none

ONBOOT=yes

BRIDGE=br0

IPV6INIT=no

IPV6_AUTOCONF=no

IPADDR=0.0.0.0

PREFIX=24`

Forwarding is disabled(no NAT), firewalld is disabled, ipv6 autoconf is disabled in sysctl.conf. Traffic is flowing perferctly from a machine inside p1p2 towards outside through p1p1.

I am stuck and any help is appreciated.

PS: This setup worked perfectly with debian 5 (2.6 kernel)but after an upgrade to debian 6 or 7 or 8, got kernel panic on interface drivers randomly. Tried both Intel card and Broadcom card with same result. A bug in brctl maybe? But anyways centos7 is running at least stable for two days.

You have confused your networking layers. Handwavingly, iptables works for network-layer forwarded IP packets and not for link-layer forwarded ethernet frames, which is the type of forwarding done by a bridge.

A bridge works by keeping a list of which MAC addresses are seen on which ports. So traffic can flow from p1p to p1p2 without doing any IP routing.

The br0 interface is a pretend interface on the bridge. It's treated like any other interface. So non-broadcast traffic from a MAC via p1 to a MAC via p1p2 doesn't transit interface br0 (although it is obviously on bridge br0, and it's a real shame Linux uses the same name for both the pseudo-interface and for the bridge).

There's a nice summary of what you are trying to do at the start of this Shorewall web pages. Basically you configure the bridge and make it work. Then set the IP forwarding sysctl (or iptables won't work at all). In your iptables rules you need to express your rules using the physdev iptables module (and of course you can list other modules after that).

Got it now. Turning on Forwarding does not enable some kernel variables that are needed so I had to manually enable them. These are,

net.bridge.bridge-nf-call-ip6tables=1

net.bridge.bridge-nf-call-iptables=1

net.bridge.bridge-nf-call-arptables=0

I turned off arptables since I don't need it.