Hardware: Asus RT-AC88U - with 8 ports (4+4) over two switchesOS: Asuswrt-Merlin 380.68 using kernel 2.6.36.4brcmarmI'm trying to setup private VLANs to enable port isolation on this router. Each physical Ethernet port should only be able to communicate with the eth0 interface (WAN) for Internet access.Netfilter/iptables only sees the br0 bridge interface, not the physical interface.As a result, ebtables rules will be needed to unbridge the frames and perform dropping.Each physical Ethernet port has its own private VLAN (i.e., eth1.1, eth1.2, etc.).Robocfg will be used to assign private VLANs to physical ports. For example ...robocfg vlan 10 <port#> 8tHow do you determine when a port should be tagged ?
When to tag physical ports on private VLANs?
vlan;tagging;private network
You do not trust any of the (LAN) ports so the only tagged port should be the one of eth1.It is not clear to be which interfaces are bridged and it may not matter for your case but iptables does see the bridge ports. Have a look at the physdev module.