From: "Dmytro O. Redchuk" <dor@ldc.net>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] Not routing for 1 host?
Date: Tue, 04 Apr 2006 07:09:03 +0000 [thread overview]
Message-ID: <20060404070903.GD4419@ldc.net> (raw)
In-Reply-To: <A3D1526C98B7C1409A687E0943EAC4107DEBA4@obelix.askesis.nl>
On Tue, Apr 04, 2006 at 08:55:37AM +0200, Joost Kraaijeveld wrote:
> Hi,
>
> I want to stop routing for 1 particular host in my network. I thought that this would do it:
>
> iptables -D INPUT -d aaa.bbb.ccc.ddd -j DROP
> iptables -D INPUT -s aaa.bbb.ccc.ddd -j DROP
>
> But that still shows traffic. What is the corract way to do that?
If you'd like to do it in this way -- use FORWARD instead of INPUT.
Forwarded traffic never travels INPUT/OUTPUT chains.
The same but better, possibly:
#
iptables -I FORWARD 1 -i <input_iface> -s aaa.bbb.ccc.ddd -j DROP
# if host is not being NAT'ed:
iptables -I FORWARD 1 -i <output_iface> -d aaa.bbb.ccc.ddd -j DROP
Start with this, and read the manual :-)
(You shouldn't use `-D' above anyway)
You could use policy routing, too, I guess.
>
> Groeten,
>
> Joost Kraaijeveld
> Askesis B.V.
> Molukkenstraat 14
> 6524NB Nijmegen
> tel: 024-3888063 / 06-51855277
> fax: 024-3608416
> e-mail: J.Kraaijeveld@Askesis.nl
> web: www.askesis.nl
--
_,-=._ /|_/|
`-.} `=._,.-=-._., @ @._,
`._ _,-. ) _,.-'
` G.m-"^m`m' Dmytro O. Redchuk
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
next prev parent reply other threads:[~2006-04-04 7:09 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-04-04 6:55 [LARTC] Not routing for 1 host? Joost Kraaijeveld
2006-04-04 7:00 ` Martin Volf
2006-04-04 7:09 ` Dmytro O. Redchuk [this message]
2006-04-04 7:20 ` Joost Kraaijeveld
2006-04-04 7:25 ` Joost Kraaijeveld
2006-04-04 7:34 ` Dmytro O. Redchuk
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20060404070903.GD4419@ldc.net \
--to=dor@ldc.net \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.