[a-gave]

WIP

Retrying the approach of #1214:

• using a better hotplug script that do bridge fdb replace instead of flush and then add
• the hotplug script is attached both to net and iface events for the devices anygw and br-lan
• a nftable rule that guards ingress: should not be from an anygw mac
• a nftable rule that guards egress: should not be to an anygw mac

Works so far on:

cudy-wr3000s-v1 (dsa) ---- switch ----- mikrotik_sxtsq-5-ac (dsa)
                              |
                           client

[pony1k]

better:

MACVLAN_MAC=$(cat /sys/class/net/$MACVLAN_INTERFACE/address)

[a-gave]

Thanks! Done

[pony1k]

Did you check if the nftable rules actually catch packets? Just curious, why are you filtering on dsa conduit ports, like eth0 and not on lan1, lan2, etc.? Are you sure this works with all switches? From what I've read, the packets passing here would use a switch specifc tagging protcol that may change the location of the mac source address in the frame.

If outgoing frames from anygw mac address are prevented from leaving through ethernet ports, wouldn't that break internet connection for clients connected via cable?