Hi, >>1) routed and natted network => Active DHCP. If DHCP on a bridge block >>port 67 and 68 from outside with iptables. We don't need to plug a physical interface (ethX) on a bridge for nat/routed. (And dhcp can't be routed). So I we need to block it only for bridged network.