Example: Stateful bridge firewall

The following example shows how to deploy a stateful bridge firewall, this assumes the bridge interface has no IP address.

Assuming a bridge with two ports, eth0 and eth1.

• A desktop computer is connected to bridge port eth0
• A web server (with SSH for remote administrador) is connected to bridge port eth1
• Uplink is bridge port eth2

The following policy allows for the desktop computer and the web server to initiate any connection. From the outside:

• no connection can be initiated to the desktop computer
• connections to the HTTP and SSH service to the server are allowed

From inside the bridge, the desktop computer and the web server can initiatiate connections to anywhere:

Code: [Sélectionner]

% nft add table bridge filter
% nft add chain bridge filter forward '{type filter hook forward priority 0; }'
% nft add rule bridge filter forward ct state established,related accept
% nft add rule bridge filter forward iif { eth0, eth1 } oif eth2 ct state new accept
% nft add rule bridge filter forward iif eth2 oif eth1 ct state new tcp dport { 22, 80, 443 } accept

Source : Bridge filtering (wiki.nftables.org)

You should get a device that has two “true” Ethernet interfaces. Some super cheap routers actually only have one Ethernet interface and use port-based VLANs on the built-in switch to split this one interface into multiple.
This will severely limit achievable throughput/bandwidth. Chances are you wouldn’t be able to use these anyway (no OpenWrt support).

[...]

You must make sure the device is connected to your existing network such that no traffic can bypass its CPU. On a typical router, you’d just connect the WAN port to the uplink router (your existing modem/router device)
and everything else to the LAN side.

[...]

Hardware offloading interferes with filters, because the switch chip deals with traffic internally. It should however not apply to bridges between physical interfaces on the CPU/SoC.

Bridge Fast forward may interfere with filters, too, and may have to be disabled.

Source : Daniel B. (Can OpenWRT serve with a switch and do IP filters and how? -- SuperUser.com)

Common pitfalls using DSA setups

Once a master network device is configured to use DSA (dev->dsa_ptr becomes non-NULL), and the switch behind it expects a tagging protocol, this network interface can only exclusively be used as a conduit interface. Sending packets directly through this interface (e.g.: opening a socket using this interface) will not make us go through the switch tagging protocol transmit function, so the Ethernet switch on the other end, expecting a tag will typically drop this frame.

Source : Linux Kernel Documentation : The DSA Architecture.