I'm new to centos and networks and I was reading documents about how to use direct commands on centos7 firewall-cmd using man 1 firewall-cmd I saw this line:

The first argument of each option has to be ipv4 or ipv6 or eb. With ipv4 it will be for IPv4 (iptables(8)), with ipv6 for IPv6 (ip6tables(8)) and with eb for ethernet bridges (ebtables(8)).

Can somebody explain simply what eb(ethernet bridge) is and give me a vision to its usage as a result I could know when should I use eb rather than ip if I want to setup my firewall rules on a correct format.

  • Unfortunately, questions about host/server configurations are explicitly off-topic here. You could try to ask about that on Server Fault for a business network, or on Super User for a personal network.
    – Ron Maupin
    Apr 5 '17 at 19:22

An ethernet bridge bridges two ethernet segments at layer-2. An ethernet switch is an ethernet bridge, it just usually has a lot more interfaces than a simple bridge.

Bridges operate at layer-2, so they do not know or care about the layer-3 (IPv4, IPX, IPv6, AppleTalk, etc.) or layer-4 (TCP, UDP, etc.) protocols being carried by the layer-2 protocols being bridged.

A bridge will use spanning tree to create a loop-free layer-2 path, and it will maintain a MAC address table in order to be able to know out which interface each MAC address on the LAN is. That lets the bridge send traffic directly to where it needs to go, eliminating the wasteful flooding of frames.

Some bridges can use VLANs and trunks.

Transparent bridges, e.g. ethernet switches, bridge like-to-like LANs, and they do not modify the frames (except maybe to add a VLAN tag on a trunk link) or the frame payloads. Translating bridges, e.g. Wi-Fi APs, will need to modify the frames in order to translate from one LAN protocol to another LAN protocol, e.g. ethernet to Wi-Fi.

  • Thanks for reply and sharing info but It wasn't much helpful for me because It seems too complex and confusing for me and I didn't find out how can I use such information for my firewall rules. Apr 5 '17 at 20:03
  • Firewalls usually work at layer-3 and above. Bridges work at layer-2. You really need to educate yourself about the network layers, and what each does. Trying to implement a firewall with your knowledge level will probably leave you wide open. Your company should spend a little money for a consultant to set this up.
    – Ron Maupin
    Apr 5 '17 at 23:42

Basically your linux machine can act as:

  • a server, accepting traffic that will be passed to an application, like a web server. In this scenario iptables are used to filter which services are accessible from which machines

  • a router, transferring network traffic from an IP network to another IP network. In this case, iptables are used to filter which traffic is allowed to pass, based typically on IP source and destination, protocols (UDP, TCP, ICMP...) and ports

  • a switch, transferring network traffic from an ethernet segment to another ethernet segment, in the same way as a network switch. In this case you will use ebtables to filter traffic based, for example on source and destination mac address.

This last case is less common, since hardware network switches are inexpensive and more efficient to do it. The most common use case I can think of is when the machine is an hypervisor and you bridge the physical network interface card (NIC) with virtual network interface (VIF) of virtual machines.

Note in all this case there's more advanced use of ip/eb tables like logging, NAT, QoS, MSS Clamping etc...

You must first define what you want to achieve and then select the proper tool to do it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.