I have a question about the bridge vs router packet filtering using firewalls. I know the basics of the router and bridge and on which layers they work. I just wanna know that on bridge how does packet filtering works, I mean on the basis of mac addresses or bridge interfaces, etc. What things are used in the bridge for packet filtering.
Some vendor products may operate (with regards to forwarding traffic) as a bridge but still have the ability to inspect and drop traffic based on higher layer information. For example, a Cisco Adaptive Security Appliance can operate in bridging mode or routing mode, but still inspect and drop traffic based on layer-4 (or sometimes higher) information. Some Cisco switches can also filter traffic by IP address or TCP/UDP port on a layer-2 switchport.
In theory, a router should only be able to filter based on layer-3 information, but every recent “enterprise” router supports stateless access-lists with the ability to filter on IP protocol and tcp/udp port.
The major difference is which (current) role the filtering device has in a network.
It can be a router, then it's a network-layer device, or a bridge, then it's a link-layer device. The main point is that all traffic to be controlled/filtered must run through that device.
Technically, firewall and security functions need to inspect the network (L3), the transport (L4) and the application layer (L7) - the more, the better. Of course, you can filter by any layer, regardless of whether it's a switching ("transparent", "on-wire") or a routing firewall. It only depends on the capabilities of that firewall. Many firewalls can use either mode, sometimes the mode limits the feature set.
If your question aims at filtering in switches (L2 or L3): these ACLs normally use L3 and L4 information only. These can e.g. limit DNS queries to outside servers or deny SMTP to unknown servers but they can't filter by URL or HTTP host name, or identify malware.