Path: csiph.com!fu-berlin.de!uni-berlin.de!news.dfncis.de!not-for-mail From: Kevin Osthoff Newsgroups: comp.os.linux.networking Subject: Separate two network bridges on linux Date: Thu, 21 Jun 2018 22:11:14 +0200 Lines: 49 Message-ID: <878t77c331.fsf@gmx.de> Mime-Version: 1.0 Content-Type: text/plain X-Trace: news.dfncis.de BlQgkK3ZKBH1t0wHpqnxhgLppnaEJTTQu5/64Eey7e/iJe5QFCa3lKZxcE Cancel-Lock: sha1:5IXDWJUhNLw6WOmefZGjKE5Ugzk= sha1:sDzrebbO/bqWTcl7khy4Rp3DfWc= User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) Xref: csiph.com comp.os.linux.networking:4138 Hi! I am currently trying to setup a router for my homenetwork using linux (Archlinux to be more specific). The embedded board i am using has 3 lan interfaces, called wan0, lan0, lan1 and two wifi cards, called wifi0 and wifi1. I want to have two separate networks, one for my guests and for my family and me. My current setup looks like this : > +-------+ > | wifi0 +----------------+ > +-------+ +----+---+ > | brg0 | > +-------+ +----+---+ > | eth0 +----------------+ > +-------+ > +-------+ > | wifi1 +----------------+ > +-------+ +----+---+ > | brg1 | > +-------+ +----+---+ > | eth1 +----------------+ > +-------+ I configured a bridge containing lan0 and wifi0, called brd0, with ip address 192.168.10.1/24 and a bridge containing lan1 and wifi1, called brd1, with ip address 192.168.20.1/24. On brd0 as well as brd1 dnsmasq is running in dhcpd mode to propagate ip addresses to clients in the range 192.168.10.50-125 for brd0 and range 192.168.20.50-125 for brd1. The 192.168.20.1/24 network is my guest network, while 192.168.10.1/24 is my home network. This setup works so far. However, one thing took me by surprise. I though, because guest and home network are in two different subnets the traffic between them is also separated. However, when i am connect to the guest network i can also reach services and computers on the home network, even though no static router or forwarding is set. ( the other way around is also true). I guess this has something to do how bridge devices work under linux. My question is, why does this happen, how to configure the router so that both networks are separated form each other? Do I need to use traffic filter rules? Can this be implemented with etables? Or is my setup somehow broken and it should not be possible to reach service from one network to the other? -- No fun. Not ever!