[...] How can i catch the IP traffic? i can acces my printer, so i know the traffic is present somewhere..
I'm not quite sure what exactly you're asking, since the headline suggests that you're looking for "LAN traffic" (which sounds a bit like you're potentially also intereseted in the traffic between the LAN ports) but then, you're saying that you're interested in the IP traffic of the guest WLAN network (which more matches your use case).
The differentiation is important on technical detail level because the traffic between the LAN ports is definitiely handled in a hardware accelerated way (unless you switch it off)
and usually there's no software bridge configured between LAN ports (although one can create bridged groups there I think) so
ebtables will never get involved by definition there (it's a switch, not a bridge). Opposed to that, a software bridge is active between LAN and any WLAN by default, so
ebtables always come into play there. I'm not 100 % sure about HW accel in this case -- I wouldn't exclude the possibility regarding one important aspect of it; see below.
Now regarding the hardware acceleration: My impression is that
in general it may be applied even where there's a bridge, but only after a connection has been established; e.g. the first packet of a TCP connection will undergo bridging and / or routing decisions and the following packets may not. At least that's what I seem to have observed. (I'm very interested in any insight you may have because I'm not yet finished with a fully flavoured guest WLAN isolation approach.)
Having said that, it helps to visualise how
ebtables work. If you take a look at the following image which originates from
http://ebtables.netfilter.org/br_fw_ia/br_fw_ia.html:
Obviously, there's something going on in
<Processing> which may result in
|Bridging| not being applied.
Let's look at the details:
Even worse, the
FORWARD chain which you use does not always come into play. You may want to read the linked article to understand which rules belong where.
Conclusion: The first packet of a TCP connection may have to undergo
<Routing> (aka
iptables) and the following packets may even bypass the
ebtables /
iptables decisions due to HW accel.
No offense but all
ebtables related posts which I found here so far were either not helpful for my case (guest network isolation) or BS (meaning not exactly wrong, but at the same time not right or lacking in-depth insights -- more located at the "it somehow works" level) so my personal advise would be to stick more to
manuals, reference examples etc while keeping ASUS specialties (HW accel) on one's mind. Of course, that all depends on how professional your setup needs to be.
And
please share your insights and results. I believe you'll get a lot of attention and this powerful topic does not seem to be understood very well so far.
