How to block trafic on a bridge interface?

Hello there...

I have a 2-nics Linux box configured as a bridge 'br0'.
World comes in via either nic (eth0 or eth1) and network is fed via the
other nic (eth1 or eth0 depending on above, should be irrelevant).

I have a non trivial question and PLEASE avoid the 'use iptables' answer
unless you know what rule to apply to which chain and on which interface
(eth0/eth1/br0).

Non trivial question is:
How do I block specific IP addresses/networks from traversing the bridge?
Or in other words:
I want all connections from a particular address/subnet to be DROP(ed) in
that bridge.

Neither FORWARD nor INPUT will catch the packet in br0 because it is neither
addressed to the box not NAT(ed), and apparently neither eth0 nor eth1 will
hand packets to netfilter.
Thanks.
ET

PS: Merry Xmas to all... :)
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss