Path: csiph.com!eternal-september.org!feeder.eternal-september.org!reader02.eternal-september.org!.POSTED!not-for-mail
From: Stefan Monnier <monnier@iro.umontreal.ca>
Newsgroups: comp.os.linux.networking
Subject: Re: Separate two network bridges on linux
Date: Thu, 21 Jun 2018 22:01:52 -0400
Organization: A noiseless patient Spider
Lines: 26
Message-ID: <jwvvaabbmyj.fsf-monnier+comp.os.linux.networking@gnu.org>
References: <878t77c331.fsf@gmx.de> <slrnpinvil.31ka.grahn+nntp@frailea.sa.invalid>
Mime-Version: 1.0
Content-Type: text/plain
Injection-Info: reader02.eternal-september.org; posting-host="fdd9c3c115719794a59e29921b85bf6f"; logging-data="497"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX196QX8D11oy0eYBKrV64yW7"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux)
Cancel-Lock: sha1:HdbQuhuW7deisXeAdua3sNqqdhg= sha1:mg6b0JKDA6I/wpz2ToILx5n6HVU=
Xref: csiph.com comp.os.linux.networking:4146

> Why not do it the straightforward way -- just a router with
> three networks attached, and NATing against the internet on
> a fourth interface?
>
>      +-----+
> world|     +---- 196.168.1/24 ethernet
> -----+     +---- 196.168.2/24 wifi
>      |     +---- 196.168.3/24 guest wifi
>      +-----+
>
> That would make it easier to reason about.

Actually, his setup is already even simpler:

         +-----+
    world|     +---- 196.168.10.0/24 bridge0
    -----+     +
         |     +---- 196.168.20.0/24 bridge1
         +-----+

He needs iptables to stop the flow between the two bridges, just like in
your example, you'd need iptables rules to stop the flow between "guest
wifi" and "wifi".


        Stefan