iptables 的问题请教。

admin@R7000-9B31:/# ifconfig wl1.3 wl1.3 Link encap:Ethernet HWaddr DE:EF:09:A5:9B:38 UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1 RX packets:42189 errors:0 dropped:0 overruns:0 frame:1633 TX packets:59226 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:5041910 (4.8 MiB) TX bytes:62593037 (59.6 MiB) 

这是启用 asuswrt-merlin 自带的客人网络功能后系统产生的接口，我想对这个走这个接口的设备做一些限制。

不过测试命令 iptables -A INPUT -i wl1.3 -j DROP 时发现没有起到拦截的效果，在 FORWARD 链下试了试也没用，没有搜索出个所以然来，有谁清楚这里面的道道吗。 是不是和下面的某个命令有冲突？下面是系统重启后 iptables -S 得到的结果。

-P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N FUPNP -N NSFW -N PControls -N SECURITY -N SECURITY_PROTECT -N logaccept -N logdrop -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD ! -i br0 -o ppp0 -j DROP -A FORWARD ! -i br0 -o eth0 -j DROP -A FORWARD -i eth0 -m state --state INVALID -j DROP -A FORWARD -i br0 -o br0 -j ACCEPT -A FORWARD -j NSFW -A FORWARD -m conntrack --ctstate DNAT -j ACCEPT -A FORWARD -i br0 -j ACCEPT -A FUPNP -d 192.168.50.100/32 -p tcp -m tcp --dport 22000 -j ACCEPT -A FUPNP -d 192.168.50.100/32 -p tcp -m tcp --dport 22000 -j ACCEPT -A PControls -j ACCEPT -A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN -A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP -A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN -A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP -A SECURITY -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j RETURN -A SECURITY -p icmp -m icmp --icmp-type 8 -j DROP -A SECURITY -j RETURN -A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options -A logaccept -j ACCEPT -A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options -A logdrop -j DROP 

以及 ebtables 的结果。

admin@R7000-9B31:/# ebtables -L Bridge table: filter Bridge chain: INPUT, entries: 0, policy: ACCEPT Bridge chain: FORWARD, entries: 2, policy: ACCEPT -i wl1.3 -j DROP -o wl1.3 -j DROP Bridge chain: OUTPUT, entries: 0, policy: ACCEPT