When does a packet reach the forward hook in nftables bridge filtering?

Installing and Using OpenWrt
1

My specific question is so I can understand when packets will show up in the forward hook for nftables when doing network bridge filtering. I'll also offer context for what I'm trying to achieve.

I'm familiar with using nftables and when packets go into the forward hook at layer 3. On layer 3 packets hit the forward hook when the destination IP address is not a local IP address for the machine and the packet is going to have to be routed.

I'd like to confirm my understanding for when the forward hook is used when doing bridge filtering and thus the decisions are being made at layer 2. My assumption is that in bridge filtering the forward hook will be hit when the destination MAC address is not the MAC address for the bridge device. Is this accurate?

What I'm trying to achieve is wireless client isolation when multiple access points are in use and all of the access points share a common VLAN. I've done some searching and reading and it's difficult to separate the signal from the noise here. I've seen lots of different suggestions for how to do this ranging from "enable client isolation on the device associated with the wireless radio and set a filtering rule to drop all packets in the forward hook for the bridge device between the wireless device and the vlan" to what appears to be rather over complicated filtering setups.

I'd like to actually understand exactly what I'm configuring these devices to do so I can be confident I'm configuring them correctly. I'm leaning towards "enable client isolation on the device associated with the wireless radio and set a filtering rule to drop all packets in the forward hook for the bridge device between the wireless device and the vlan" is the correct answer.

Thanks for your help.

2

You are wrong

Arp and bridge are different cf atptables vs ebtables.

3

This is a less than helpful response. I wasn't asking about ARP behavior. My question is "when does a packet hit the forward hook" and that answer is not provided in the wiki entry you linked. The entry says:

which is missing the criteria the kernel will use to decide if a packet is to be forwarded along the bridge or not.

That would be why I'm asking. Do you only know that it's wrong or do you also know what would be right? Providing what is right would be helpful.

4

fdb has zero to do with arp, it works with any including non-internet protocols like stp and whatev er else happens in ethernet segment.

Cannot affirm your misconception helpfully, sorry.