DHCP issue - iptables rules not hit when using ebtables - MAC based firewall bypass

["fvancrae@xxxxxxxxxx" <fvancrae@xxxxxxxxxx>]

How can I block the DHCP request or answer for a specific MAC adress 
using iptables/ebtables?

I am using ebtables on my firewall to have one consumer device (client) 
bypass the firewall entirely and act as if it is directly connected to 
the internet.

For this I create a bridge (non transparant) and specify a MAC based 
rule in the BROUTING chain
-s MAC -i eth1 -j ACCEPT
-d MAC -i eth0 -j ACCEPT
BROUTING POLICY DROP

eth0 is my routers WLAN interface
eth1 is my routers LAN interface

Then I wanted to block the DHCP request for that MAC on my firewall (who 
is DHCPD)
but it seems that no iptable or ebtable rule can be used to block this 
packet (or even an outgoing packet of my DHCPD)

My client always gets an IP inside my LAN.

!!This entire setup however works if I disable my DHCPD temporarily, 
boot my client (=get an external IP)
so it is really only a problem of blocking DHCP requests/responses!!

In document 'ebtables/iptables interaction on a Linux-based bridge'
http://ebtables.sourceforge.net/br_fw_ia/br_fw_ia.html
I was led to believe that iptables FILTER chain INPUT and OUTPUT are 
still traversed


My bridge config:

brctl adbr br0
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig br0 up



TIA,
Frederic
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html