I Think This Is My Favorite Firewall Command Of All Time!

Layer 2 – Ethernet Frames – Leet ARP Spoofing

ebtables -t filter -I FORWARD -i br0.1 -p ARP --arp-opcode Reply --arp-ip-src 192.168.1.1 -s ! 00:12:34:56:78:00 -j DROP
ebtables -t filter -I FORWARD -i br0.1 -p ARP --arp-opcode Reply --arp-ip-dst 192.168.1.1 -s ! 00:12:34:56:78:00 -j DROP

Layer 3 – Second Favorites – Lazy DHCP Snooping

ebtables -t filter -I FORWARD -i eth0.1 -p IPv4 --ip-proto udp --ip-sport 67 -j ACCEPT
ebtables -t filter -A FORWARD -i wifi+  -p IPv4 --ip-proto udp --ip-sport 67 -j DROP

Note: Most of these commands won’t work on UAP-U7-PRO APs I believe due to hardware based frame/packet routing/forwarding – I have since enabled arp-proxy and dhcp-snooping in the UI network controller. You can also enable client-isolation and performing the filtering between clients on the router instead!

~

[kmod-nft-bridge]

table bridge ethernet {
    chain arp_input {
        type filter hook input priority filter; policy accept;
        meta ibrname "br0.1" ether type arp arp operation reply jump arp_filter
    }
	chain arp_forward {
        type filter hook forward priority filter; policy accept;
        meta ibrname "br0.1" ether type arp arp operation reply jump arp_filter
    }
    chain arp_filter {
        ether saddr 00:11:22:33:44:00 arp saddr ip 192.168.1.1 accept
        log prefix "DROP ARP REPLY: " drop
    }
    chain dhcp_forward {
        type filter hook forward priority filter; policy accept;
        udp sport 67 jump dhcp_filter
    }
    chain dhcp_filter {
        iifname "eth0.1" accept
        iifname "wifi*" log prefix "DROP DHCP REPLY: " drop
    }
}

~

Leave a comment