iptables on openwrt router: logging connections to a host from clients on the same subnet

Question

I am trying to setup an auto wake-on-lan setup using my router that is running OpenWRT 14.07, Barrier Breaker. My idea is that the router monitors any connection attempts to the host I want to wake up and in the case it registers such an event it sends the magic packet to wake the host. I have been trying to do this using iptables to write any such connection attempt to a log-file, which I could then check from another script. For iptables I arrived at this rule:

iptables -I FORWARD 1 -d 192.168.1.20 -p tcp -j LOG --log-prefix "WAKE_UP_EVENT"

192.168.1.20 is the fixed IP of the host I want to wake. I could then use logread in a bash script to monitor the logs and send the magic packet if it finds WAKE_UP_EVENT. Something like that anyway.

While this works fine when trying to connect using SSH from a client outside of my home network (e.g. the internet), it does not work for clients on the same subnet as the host inside my home network. If I understand correctly the reason for this is that the FORWARD rule is for any packets that "pass" iptables, but in this cases the packets stay within the same network and have no(?) contact with iptables.

So two questions:

1) Is my understanding of the behavior correct?

2) Is there any way of achieving what I am trying to do, be it with iptables or another way?

I have been trying to get this working for 4 hours to no avail and without finding helpful information. Hope somebody a can give me some helpful input. Thanks in advance!

Answer 1

By default bridged traffic doesn't hit iptables. You can enable it in /etc/sysctl.conf:

# disable bridge firewalling by default
net.bridge.bridge-nf-call-arptables=0
net.bridge.bridge-nf-call-ip6tables=0
net.bridge.bridge-nf-call-iptables=1

Then reload the settings:

sysctl -p

Ref: OpenWRT: Netfilter/Nftables