I'd like to limit a specific MAC to communicating only with devices on the LOCAL LAN.  Here is my attempt (output from ebtables -t nat -L command)Bridge table: natBridge chain: PREROUTING, entries: 0, policy: ACCEPTBridge chain: OUTPUT, entries: 0, policy: ACCEPTBridge chain: POSTROUTING, entries: 1, policy: ACCEPT-d f0:de:f1:1e:e4:83 -j LOCALBridge chain: LOCAL, entries: 1, policy: DROP-p IPv4 --ip-src 192.168.6.0/24 -j OKAYBridge chain: OKAY, entries: 1, policy: ACCEPT-j ACCEPTWhen these rules are in place the linux router becomes unreachable from the device f0:de:f1:1e:e4:83 which has IP Address 192.168.6.70. ICMP ping stops along with all other services.If I change the policy on the chain named LOCAL to ACCEPT then all services resume working for f0:de:f1:1e:e4:83.  This tells me that the POSTROUTING rule is working and we are evaluating the LOCAL rules that should only allow packets sourced from the LAN to pass.  So why does the -p IPv4 --ip-src 192.168.6.0/24 -j OKAY not permit ICMP ping exchanges between 192.168.6.70 and 192.168.6.254?
Baffled by an ebtables rule that doesn't work: Allowing only local LAN traffic
iptables
As it turns out, ethernet (as controlled by ebtables) supports many protocols beyond IPV4.  Crucially the ARP packets were being dropped by the default policy in LOCAL chain above.The fix was to only send IPv4 packets to the LOCAL chain in POSTROUTING, and allow the default ACCEPT in POSTROUTING allow the ARP ethernet frames to pass across the bridge.Bridge chain: POSTROUTING, entries: 1, policy: ACCEPT-p IPv4 -d f0:de:f1:1e:e4:83 -j LOCAL