Path: csiph.com!feeder.erje.net!1.eu.feeder.erje.net!news.szaf.org!fu-berlin.de!uni-berlin.de!news.dfncis.de!not-for-mail From: Kevin Osthoff Newsgroups: comp.os.linux.networking Subject: Re: Separate two network bridges on linux Date: Fri, 22 Jun 2018 20:18:55 +0200 Lines: 31 Message-ID: <87tvpuadm8.fsf@gmx.de> References: <878t77c331.fsf@gmx.de> <87y3f7ajhn.fsf@gmx.de> Mime-Version: 1.0 Content-Type: text/plain X-Trace: news.dfncis.de STpu9zrzV0fVDyfd8ZpOkAUhG0C5noqcfTkm1bjZfFECYEQLkfjPBT1KaI Cancel-Lock: sha1:hKC4fC+BUDAB3nbWck/gh20h6WM= sha1:PS0Sm9NK+cQN8+qaFkqflS7tRJ8= User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) Xref: csiph.com comp.os.linux.networking:4150 Tauno Voipio writes: > The point is pretty simple: Unless you use the iptables to > prevent it, the kernel takes a packet coming from 192.168.20.x > and forwards it to 192.168.10.y if it is addressed to go there, > and the same for return packets. Ok i think that is the point. If i use real hardware interface (eth0/lan0 and eht1/lan1) the kernel don't forward packages between them? But if i use bridges, packages are forward between bridges even though they bridge different interface (brdg0 bridges lan0/wifi0 and brdg1 lan1/wifi1)? Is this correct? If so, why is this implemented this way? Or does the kernel always forward packages between interface? Sorry for the confusion. I guess i didn't articulate my problem in an adequate way. But English is not my first language, so i am struggling here :) I know how setup the filter rules. But i had the opinion, that filtering is not necessary between 192.168.20/10 because i have two independent networks. > To separate the networks, you need two rules in iptables: > packets from 192.168.20.0/24 to 192.168.10.0/24 dropped, > packets from 192.168.10.1/24 to 192.168.20.0/24 dropped. Best regards Kevin -- No fun. Not ever!