I want to be able to redirect all traffic which have a specific destination IP (say, passing through a software bridge on Linux (br1), to localhost.

As far as I understood I need to do something like:

ebtables -t broute -A BROUTING -p IPv4 --ip-dst -j redirect --redirect-target DROP

and then DNAT-ing/SNAT-ing via iptables.

The problem is that the device on which I am trying to configure it seems to not support the -j redirect part. Is there any way (without recompiling the kernel) to do the same with help of iptables/ebtables? For example doing:

ebtables -t broute -A BROUTING -p IPv4 --ip-dst -j DROP

And then do some iptables magic?

  • 2
    Just read the description of the redirect target in man ebtables. For BROUTING you can replace the redirect target with multiple dnat targets that will specify the incoming bridge port's MAC (so one rule per bridge port ). Hope this helps. I'm not sure about the overall method though, but I don't have much experience on this. – A.B Apr 28 '18 at 19:15
  • Thanks for the tip, I think I'll try to look into DNAT-ing. That's actually good enough for me as I need to redirect only packets from one bridge port. – Evengard Apr 30 '18 at 1:03

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.