I am trying to log internal(eth0->eth0[via br0]) traffic to syslog on DD-WRT.


Bridged traffic is not seen by iptables. The same traffic is also not visible via ebtables.

Things I Tried

I would post what I have already tried but I have basically tried everything, quick recap:

insmod ebt* #load all ebtables and extensions

echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables

ebtables -t nat -A PREROUTING --logical-in br0 -p ipv4 -j redirect --redirect-target ACCEPT

add logging[as first rule] to all tables and chains of both ebtables and iptables

"trick" iptables by redirecting "bridged" traffic to the network layer

SETUP(basically stock DD-WRT v3):

br0 = eth0[lan] + ath0[wlan]

no static route

no STP

What I Want[Please]

I want to log all traffic from to, basically anything BETWEEN devices on eth0(lan ports)

[I can log all other traffic crossing the bridge, from lan to wan and vice versa. After reviewing the logs I did in fact have this working very briefly via some combination of ebtables and iptables(example output: 2016-XX-XXTXX:XX:41-XX:00 XXXXX kernel: [ XXX.850000] ACCEPT_ebt IN=br0 OUT=br0 MAC=XXXXXXXXXXXXXXXXXX SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=35259 DF PROTO=TCP SPT=45879 DPT=22 etc.... ]

Point me in the right direction

Tell me what I'm doing wrong

Tell me how to achieve this


Module Size Used by ebt_802_3 708 0 ebt_among 2116 0 ebt_arp 1572 0 ebt_arpreply 1060 0 ebt_dnat 804 0 ebt_ip 1252 0 ebt_limit 948 0 ebt_log 2100 0 ebt_mark 692 0 ebt_mark_m 628 0 ebt_nflog 660 0 ebt_pkttype 580 0 ebt_redirect 868 0 ebt_snat 852 0 ebt_stp 1780 0 ebt_ulog 2724 0 ebt_vlan 916 0 ebtable_broute 756 0 ebtable_filter 916 0 ebtable_nat 916 0 ebtables 14253 3 ebtable_broute,ebtable_filter,ebtable_nat


Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 10.11.AA.BB UG 0 0 0 ppp0 10.11.AA.BB * UH 0 0 0 ppp0 SerVer UG 0 0 0 br0 * U 0 0 0 lo * U 0 0 0 br0 * U 0 0 0 br0

  • 1
    This isn't exactly what you are looking for, but will get you to the same place: dd-wrt.com/wiki/index.php/… – Argonauts Apr 26 '16 at 23:55
  • Thank you Argonauts, unfortunately rflow is not available in this build. – codemonk113 Apr 27 '16 at 20:47
  • If you are still looking for help, could you provide a little more context? Specifically, are looking to log all traffic that crosses from lan to wan, lan to lan AND wan to lan, or those two + a vpn or other traffic? The way I read it it sounds like you want everything. – Argonauts Apr 27 '16 at 21:59
  • @ Argonauts updated with more info, I can log everything EXCEPT lan to lan, which is what I'm trying to accomplish. – codemonk113 Apr 27 '16 at 22:52

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.