In this lesson, you will learn how to enforce firewall policies directly on bridge interfaces and virtual switch ports to secure traffic before it even touches the routing stack.
The Problem with Routing-Layer Filtering
When you run virtualized workloads or containers, traffic often moves between virtual machines (VMs) or containers residing on the same host. If you rely solely on iptables or nftables in the forward chain, you might miss this "East-West" traffic because it is switched at Layer 2. By the time a packet hits the IP-layer firewall, the host may have already bridged it directly to the destination virtual interface, bypassing your security policy entirely.
Moving Up the Stack with bridge-nf
The Linux kernel provides a mechanism called bridge-netfilter that allows the Netfilter hooks to trigger on frames passing through a bridge. By enabling this, you can force bridged traffic to traverse your nftables or iptables rules.
To implement this, ensure the br_netfilter module is loaded. You can then apply filtering policies to the bridge interface itself. For example, if you have a virtual bridge named br0, you can drop unwanted traffic originating from a specific virtual port:
# Ensure bridge filtering is enabled
sysctl -w net.bridge.bridge-nf-call-iptables=1
# Add a rule to the bridge to block traffic between specific virtual interfaces
nft add rule bridge filter forward iifname "veth1" oifname "veth2" drop
Why Filter at the Switch Layer?
Filtering at the virtual switch layer is essential for multi-tenant environments where you must isolate workloads from one another regardless of their IP configuration. Because this happens at the Layer 2/3 boundary, you gain "micro-segmentation" capabilities. You are no longer securing the host's primary gateway; you are securing the logical "wire" connecting your virtual assets. This prevents a compromised container from scanning or attacking its neighbors on the same subnet, effectively neutralizing lateral movement at the link layer.
Key Takeaway: Filtering at the virtual switch layer forces bridged traffic to obey your firewall rules, ensuring that internal host-to-host communication remains visible and restricted by your security policy.