This may seem as a stupid question to you but I need to be sure that what I am thinking is correct. I'm using a usb-wireless adapter (connected to my laptop), dnsmasq and hostapd to create a local wireless network. It is working and I can have more devices connected and ping one another. Now I would like to block the ping within hosts in this wireless LAN. I tried to use iptables on the laptop in which the usb wireless adapter is plugged in but it's not working, this is my command:

iptables -A FORWARD -p icmp -j DROP

But I can still ping. So what I think is that being the two hosts in the same wireless LAN I cannot use iptables because to send the frame the layer 3 headers are not utilized, my hotspot running on the wireless adapter is just using the 802.11 addresses fields to route the packet (L2 headers). Is it correct? Thank you

  • 1
    what is the output of cat /proc/sys/net/bridge/bridge-nf-call-iptables ? Apr 11, 2017 at 16:40
  • @user4556274 I have no entries for that. But I don't have a bridge. I have an access point setted up using this guide offensive-security.com/kali-linux/…
    – mik1904
    Apr 11, 2017 at 17:10
  • 1
    what's the output of service iptables status?
    – Zina
    Apr 11, 2017 at 17:17

2 Answers 2


First set this in the hostpad config file:


Also: disable_dgaf=1

Please read the config file for further details.

You may need this also:

iptables -A INPUT -p icmp -j DROP

It is even better idea to specify the name of the ethernet adapter so it doesn't affect the loopback adapter or any other adapters you may have.

iptables -A INPUT -i eth0 -p icmp -j DROP

For further reading:


  • Why should I use the INPUT chain, if the packet is not destined to the AP it comes in the AP and it goes through the PREROUTING and FORWARD chain not the INPUT one. Or am I wrong?
    – mik1904
    Apr 20, 2017 at 12:54
  • mik1904: depends by setting of AP - some problems can be a wan setting hardware's . cybernard: Enable or disable Downstream Group-Address Forwarding. = hs-dgaf - use the hs-dgaf command from the hotspot context to configure hotspot downstream group addressed forwarding. This option is disabled by default. When DGAF is disabled, the AP is not forwarding downstream groupaddressed frames. Apr 25, 2017 at 16:41

You should be able to use iptables, as you are host.

If not, you may need another Wireless Interface Card, and some are below $20!

  • Can you please improve your answer and explain it better?
    – mik1904
    Apr 19, 2017 at 10:11
  • I down voted you because clearly this is NOT a hardware issue.
    – cybernard
    Apr 19, 2017 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.