ebtables

List all rules

$ sudo ebtables -L

$ sudo ebtables -L --Ln

$ sudo ebtables -A INPUT -s [00:11:22:33:44:55] -j DROP

$ sudo ebtables -A INPUT -s ! [00:11:22:33:44:55] -j DROP

$ sudo ebtables -A FORWARD -p IPv4 -j DROP

$ sudo ebtables -F

$ sudo ebtables-save > [rules.txt]

ebtables [options] [command] [rule]

ebtables filters Ethernet frames at the link layer (Layer 2) in Linux bridges. It controls traffic passing through a bridge based on MAC addresses, VLAN tags, and Ethernet protocols, complementing iptables which operates at Layer 3.
Ebtables uses chains (INPUT, OUTPUT, FORWARD) and tables (filter, nat, broute) similar to iptables. It's essential for bridge firewall configurations and MAC-based access control.

-L, --list

List all rules.

Append rule to chain.

Delete rule from chain.

Insert rule at position.

Flush rules (all or specific chain).

Set chain policy.

Match protocol (IPv4, IPv6, ARP).

Source MAC address.

Destination MAC address.

Input interface.

Output interface.

Jump to target (ACCEPT, DROP, CONTINUE).

Only applies to bridged traffic. Requires kernel bridge-nf support. Legacy tool; nftables provides unified filtering for modern systems. Must be used in conjunction with iptables for IP-level filtering. Rules don't persist across reboots without save/restore.

ebtables was developed for the Linux kernel in the early 2000s to provide Ethernet frame filtering for bridges. It was modeled after iptables to provide familiar syntax. The project is now considered legacy, with nftables recommended for new deployments.

iptables(8), nft(8), brctl(8), bridge(8)