都采用netfilter实现。
Ebtables即是以太网桥防火墙，以太网桥工作在数据链路层，Ebtables来过滤数据链路层数据包。 2.6内核内置了Ebtables，要使用它必须先安装Ebtables的用户空间工具（ebtables-v2.0.6），安装完成后就可以使用ebtables来过滤网桥的数据包。
Main features of ebtables.
-
Usage analogous to iptables.
-
Ethernet filtering.
-
MAC NAT: ability to alter the MAC Ethernet source and destination address. This can be useful in some very strange setups (a real-life example is available).
-
Brouting: decide which traffic to bridge between two interfaces and which traffic to route between the same two interfaces. The two interfaces belong to a logical bridge device but have their own IP address and can belong to a different subnet.
-
Pass packets to userspace programs, using netlink sockets (the ulog watcher).
iptables --- ip层
arptables --- arp报文
