We have a Linux gateway with multiple VLANs with the default policy being DROP. We have the following rules in the INPUT and OUTPUT chains of the filter table: iptables -I INPUT -p icmp -j ACCEPT iptables -I OUTPUT -p icmp -j ACCEPT to allow pings to and from the gateway. What would be the best way to allow pings from a host on a VLAN to the VLAN interface on the gateway and everywhere else EXCEPT to other VLAN interfaces on the gateway? For example, if the gateway's VLAN interfaces had IP addresses 192.168.1.1/24 (vlan0) and 192.168.2.1/24 (vlan1) and host on vlan0 with address 192.168.1.8 must be able to ping 192.168.1.1 and other public addresses EXCEPT 192.168.2.1. There could be many VLAN interfaces so excluding each one will be not so efficient. I'm trying to see if there's a better way that add specific DROP rules for each, which can lead to a good number of rules depending on the number of VLANs. Thanks in advance for your help. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
