The ebtables program is a filtering tool for a Linux-based bridging firewall. It
enables transparent filtering of network traffic passing through a Linux bridge.
The filtering possibilities are limited to link layer filtering and some basic
filtering on higher network layers. Advanced logging, MAC DNAT/SNAT and brouter
facilities are also included.

The ebtables tool can be combined with the other Linux filtering tools (iptables,
ip6tables and arptables) to make a bridging firewall that is also capable of
filtering these higher network layers. This is enabled through the
bridge-netfilter architecture which is a part of the standard Linux kernel.