Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • But, if I understand you correctly, it should be possible to accept packets on the L3 layer in bridge tables? Still this does not seem possible when I try. Commented Feb 15 at 14:40
  • No. Bridge filtering may use L3 information, but at that point the packet hasn't reached actual L3 processing (which will have its own filtering stage before it). Commented Feb 15 at 15:11
  • My clarification question might have been poorly worded. To use L3 information would imply that a rule could match to L3 information, no? And so should be able to accept/deny packets based on i.e. IP? I understand there are the seperate stages of filtering, but I don't understand what the difference is for bridge rules if they can use the information. If I misunderstand the idea of using information could you give an example? Commented Feb 16 at 16:08
  • Bridge rules could indeed accept/deny packets based on IP address (or potentially even TCP port, or some further payload) – even physical Ethernet switches have support for ACLs which can match against L3/L4 headers despite performing L2 forwarding – the difference is in when the rules are applied. Bridge rules are applied before L2 forwarding (by destination MAC) happens; inet rules are applied before L3 forwarding (by destination IP) happens. So if bridge rules accept a packet, that's not "final" i.e. it won't allow the packet to bypass inet rules once it goes through IP handling. Commented Feb 16 at 16:28