From mboxrd@z Thu Jan 1 00:00:00 1970 From: Luca Ferrari Subject: problem with iptables - wrong rules? Date: Tue, 13 Jul 2004 18:50:55 +0200 Sender: linux-admin-owner@vger.kernel.org Message-ID: <200407131850.55496.fluca1978@virgilio.it> Reply-To: fluca1978@virgilio.it Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline List-Id: Content-Type: text/plain; charset="us-ascii" To: linux-admin@vger.kernel.org Hi, this is the situation: 192.168.1.7 linux firewall with eth0 on internet and eth1 on intranet 192.168.1.8 router for internal networks (192.168.4.0,192.168.2.0,ecc.) The firewall is the main gateway of the whole network, so packets are sent to it and redirected to the internet or the other router (192.168.1.8). I'd like to block connections to everything that is going to the router 192.168.1.8 excepts for certain machines, thus I've defined the following rules: $IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.30 -j ACCEPT $IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.37 -j ACCEPT $IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.64 -j ACCEPT $IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.3 -j ACCEPT $IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 0/0 -j DROP but it is not working, and I can connect from other machine trhu 192.168.1.8. In the OUTPUT chain packets should be already be natted, thus my doubt is that the destination address is the final one (e.g., 192.168.4.100) and not the router one. Is there a way to lock the traffic to the router using iptables? Thanks, Luca -- Luca Ferrari, fluca1978@virgilio.it