My network is like that: GW+DHCP 192.168.1.1, eth0:192.168.100.1 eth1:192.168.168.1.1 HOST1+DHCP 192.168.1.100, eth0:192.168.1.100 eth1:192.168.2.1 CLIENT1 192.168.2.100 There is a double NAT here at both GW and HOST1 The DHCP from GW is only towards the eth1 network and subnet. The DHCP from HOST1 is only towards eth1. in GW there is a masquerade rule which works fine and allows all forwarded packets. I do not want packets from clients in the CLIENT1 side of the network to get access using the nat to the local network resources but that they will have access to the internet using GW. So basically I want to allow all forwarded traffic from the 192.168.2.0/24 network to be allowed to all networks but not the localnet and the local GW resources. I am a bit in a conflict in it since the next rules should work or at least should do the trick..: ------ -A FORWARD -s 192.168.2.0/24 -i eth1 -p tcp -m state --state ESTABLISHED -j ACCEPT -A FORWARD -i eth1 -p icmp -j ACCEPT -A FORWARD -s 192.168.2.0/24 -i eth1 -p tcp -m multiport --dports 53,443,80,21,22,23,110,25,143,995,993,3128,8080 -j ACCEPT -A FORWARD ! -i eth1 -m state --state NEW -j DROP -A FORWARD -o eth1 -j ACCEPT -A FORWARD -d 192.168.1.0/24 -j DROP ------ Before I press the "save" button I would like for someone else to take a small look at it. Eliezer -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
