Re: problem with iptables - wrong rules?

["Miguel González Castaños" <mgc@tid.es>]

Hi,

 I am not sure what is your network architecture but i assume this:

 You have a LAN connected (lets call it LAN1) to the Internet through 
the linux firewall (192.168.1.7). This firewall acts also as a router 
being connected to the 192.168.1.8 router which is connected to 
different LANs.

 With the DROP rule you are blocking packets destined to 192.168.1.8 and 
come from anywhere (in this case Internet and LAN1).

 I assume when you say have NATTED the connection, you have NATTED 
connections from LAN1 to the Internet and maybe connections from the 
other LANs, am I wrong ? (maybe you should give us a picture or more 
details of what you have in your NAT rules). If so, then LAN1 and the 
other LANs are routed and not natted among them.

 Then, you should block destination to network 192.168.2.0, 192.168.4.0, 
etc...

 HTH

 BR,

 Miguel

>Hi,
>this is the situation:
>192.168.1.7 linux firewall with eth0 on internet and eth1 on intranet
>192.168.1.8 router for internal networks (192.168.4.0,192.168.2.0,ecc.)
>The firewall is the main gateway of the whole network, so packets are sent to 
>it and redirected to the internet or the other router (192.168.1.8).
>I'd like to block connections to everything that is going to the router 
>192.168.1.8 excepts for certain machines, thus I've defined the following 
>rules:
>
>$IPTABLES -A OUTPUT -o $INTIF  -d 192.168.1.8 -s 192.168.1.30 -j ACCEPT
>$IPTABLES -A OUTPUT -o $INTIF  -d 192.168.1.8 -s 192.168.1.37 -j ACCEPT
>$IPTABLES -A OUTPUT -o $INTIF  -d 192.168.1.8 -s 192.168.1.64 -j ACCEPT
>$IPTABLES -A OUTPUT -o $INTIF  -d 192.168.1.8 -s 192.168.1.3  -j ACCEPT
>$IPTABLES -A OUTPUT -o $INTIF  -d 192.168.1.8 -s 0/0 -j DROP
>
>
>but it is not working, and I can connect from other machine trhu 192.168.1.8. 
>In the OUTPUT chain packets should be already be natted, thus my doubt is 
>that the destination address is the final one (e.g., 192.168.4.100) and not 
>the router one. Is there a way to lock the traffic to the router using 
>iptables?
>
>Thanks,
>Luca
>  
>