magoo2

I found some more information out. Once I edit /etc/sysctl.conf net.bridge.bridge-nf-call-iptables=1 and run systctl -p I noticed an error sysctl: error: 'net.bridge.bridge-nf-call-iptables' is an unknown key So after further reading, it appears even though bridge-nf would do what I need it to do, bridge netfilter support needs to be enabled in the kernel. So I will now be learning how to compile the openwrt kernel... <_< Still seems strange to me that the INPUT and OUTPUT chains work...confusing It seems that enabling bridge netfilter support in the kernel has created some performance issues and so it has been disabled by default.

I'm trying to set up my pineapple MK4 (running 2.7.0) to be able to filter certain tcp ports on a bridge interface. I am able to do this same thing on my laptop running 12.04 ubuntu between two interface cards, but I can't seem to get it to work on the MK4. I realize the below steps are not persistant on a reboot as this is only a POC I am trying to achieve. The steps I take on the MK4: - I edit /etc/sysctl.conf and reboot the MK4 (I read this in another forum and have tried it both ways (with '1' or '0' -default) net.bride.bridge-nf-call-iptables=1 - I create a new bridge and add eth1 brctl addbr br0 ifconfig eth1 0.0.0.0 promisc up brctl addif br0 eth1 - I delete the pineapple exsisitng bridge and add eth0 to the new bridge ifconfig br-lan down ifconfig eth0 down brctl delbr br-lan ifconfig eth0 0.0.0.0 promisc up brctl addif br0 eth0 - I bring up the bridge ifconfig br0 192.168.1.1 netmask 255.255.255.0 up At this point traffic goes through the bridge between eth0 and eth1 (which is good) but I want to be able to filter the forwarding traffic via iptables. - so I add this to the iptables flush them iptables -X iptables -F add filter iptables -A FORWARD -p tcp --dport 80 -j DROP but it still continues to forward port 80 (or any port I put in) I have also tried iptables -A FORWARD -j DROP and it still continues to forward everything. If I do this on INPUT or OUTPUT it does work as I expect it to. What am I missing? I understand that bridge is layer 2 while iptables are layer 3 but I have read that "bridge-nf-call" (I have no idea what I am talking about) takes care of this. Do I need to install additional iptables packages maybe? Thanks in advance for any advice you may have. magoo