Hacker News Reader

Comment by paulfurtado | Hacker News Reader

Re: bridge filtering

You can use the iptables physdev extension to match based on a bridge port rather than a mac address.

So to filter between containers, you can do:

  iptables -I FORWARD -m physdev --physdev-in vetha056126 -j DROP

where vetha056126 is the name of the container's veth adapter's peer interface on the host.

View on HN

Perhaps I don't understand this rule properly, but isn't this dropping all traffic being forwarded from the interface?

When the sysctl net.bridge.bridge-nf-call-iptables=1 is set, bridged packets will traverse iptables rules. I believe this is the default on modern Linux kernels, but may not be set by default on RHEL/CentOS systems.

The iptables filter table has three chains: INPUT, OUTPUT, FORWARD. In a traditional non-bridge context:

- INPUT means packets entering the host

- OUTPUT means packets leaving the host

- FORWARD means packets being forwarded through the host which are not destined for the host itself.

In the context of a bridge, FORWARD means forwarding packets from one bridge port to another. You can test the simplest case of this with:

  iptables -I FORWARD -j DROP

by adding that rule, two containers on the same host cannot communicate with each other despite the fact that their communication did not require any traditional routing from the host. This is because the bridge traffic also traversed iptables rules.

Reply on news.ycombinator.com