Hi,
I am not sure what is your network architecture but i assume this:
You have a LAN connected (lets call it LAN1) to the Internet through the linux firewall (192.168.1.7). This firewall acts also as a router being connected to the 192.168.1.8 router which is connected to different LANs.
With the DROP rule you are blocking packets destined to 192.168.1.8 and come from anywhere (in this case Internet and LAN1).
I assume when you say have NATTED the connection, you have NATTED connections from LAN1 to the Internet and maybe connections from the other LANs, am I wrong ? (maybe you should give us a picture or more details of what you have in your NAT rules). If so, then LAN1 and the other LANs are routed and not natted among them.
Then, you should block destination to network 192.168.2.0, 192.168.4.0, etc...
HTH
BR,
Miguel
Hi,
this is the situation:
192.168.1.7 linux firewall with eth0 on internet and eth1 on intranet
192.168.1.8 router for internal networks (192.168.4.0,192.168.2.0,ecc.)
The firewall is the main gateway of the whole network, so packets are sent to it and redirected to the internet or the other router (192.168.1.8).
I'd like to block connections to everything that is going to the router 192.168.1.8 excepts for certain machines, thus I've defined the following rules:
$IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.30 -j ACCEPT $IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.37 -j ACCEPT $IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.64 -j ACCEPT $IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.3 -j ACCEPT $IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 0/0 -j DROP
but it is not working, and I can connect from other machine trhu 192.168.1.8. In the OUTPUT chain packets should be already be natted, thus my doubt is that the destination address is the final one (e.g., 192.168.4.100) and not the router one. Is there a way to lock the traffic to the router using iptables?
Thanks,
Luca
- : send the line "unsubscribe linux-admin" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
