Hello everyone,

First time poster. I've been using OpenWRT on a few WRT54GLs, both at home and at work, for a few months now. Great job!

Now on to my problem. I've been trying to set up one of my routers as a briding firewall for a few days, and after a good amount of tweaking, it works. Its configured to have two seperate bridges - one for wired communications, one for wireless. The idea is that the wired bridge will protect and filter traffic for publicly routable workstations, while the wireless is set to be completely open (in terms of the filtering) on a seperate subnet.

Each bridge has two interfaces. br0 is the wired bridge, and it has interfaces vlan0 and vlan1, the former being the trusted side of the wired network and vlan1 being the untrusted side. br1 consists of vlan2 and eth1 - the wireless uplink and the wireless device, respectively.

I've crafted a firewall ruleset that does exactly what I'm looking for, but performance isn't that great. It seems to be centered around ebtables. I've read a few posts around here saying that ebtables was removed from OpenWRT in the past due to poor performance, but was readded some time later. The issue I see relates to the net.bridge.bridge-nf-call-iptables sysctl variable. When this variable is set to active (1), I can expect much worse performance than when it's disabled (0). When its disabled, I can sustain transfer rates of around 80Mbit through the router, but with it enabled, the transfer rates are lower - around 40 Mbit with my iptables/ebtables firewall completely flushed, and around 20Mbit with the firewall active.

The firewall is not complicated in nature. It's mainly set up to deny traffic from crossing between bridges, accept all outgoing traffic from the trusted wired side of br0 and the router, and do some broad filtering of traffic from the outside world. It uses iptables mostly, but I think I could replicate just about all of it in ebtables only, which would allow me to not use the bridge-nf-call-iptables stuff in the kernel. The only problem is connection tracking of IP packets. Without those iptables statements to allow RELATED and ESTABLISHED packets through, everything would die while trying to traverse the firewall. I haven't found any way to do this in ebtables. I doubt it's possible, since ebtables does only rudimentary inspection of IP headers.

Does anyone have any ideas on how to speed things up? Any suggestions are welcome, and let me know if you need more information or specifics.

Thanks in advance!