From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?ISO-8859-1?Q?Miguel_Gonz=E1lez_Casta=F1os?= Subject: Re: problem with iptables - wrong rules? Date: Wed, 14 Jul 2004 09:36:24 +0200 Sender: linux-admin-owner@vger.kernel.org Message-ID: <40F4E278.7040108@tid.es> References: <200407131850.55496.fluca1978@virgilio.it> Mime-Version: 1.0 Content-Transfer-Encoding: 7BIT Return-path: In-reply-to: <200407131850.55496.fluca1978@virgilio.it> List-Id: Content-Type: text/plain; format="flowed"; charset="us-ascii" To: fluca1978@virgilio.it, linux-admin@vger.kernel.org Hi, I am not sure what is your network architecture but i assume this: You have a LAN connected (lets call it LAN1) to the Internet through the linux firewall (192.168.1.7). This firewall acts also as a router being connected to the 192.168.1.8 router which is connected to different LANs. With the DROP rule you are blocking packets destined to 192.168.1.8 and come from anywhere (in this case Internet and LAN1). I assume when you say have NATTED the connection, you have NATTED connections from LAN1 to the Internet and maybe connections from the other LANs, am I wrong ? (maybe you should give us a picture or more details of what you have in your NAT rules). If so, then LAN1 and the other LANs are routed and not natted among them. Then, you should block destination to network 192.168.2.0, 192.168.4.0, etc... HTH BR, Miguel >Hi, >this is the situation: >192.168.1.7 linux firewall with eth0 on internet and eth1 on intranet >192.168.1.8 router for internal networks (192.168.4.0,192.168.2.0,ecc.) >The firewall is the main gateway of the whole network, so packets are sent to >it and redirected to the internet or the other router (192.168.1.8). >I'd like to block connections to everything that is going to the router >192.168.1.8 excepts for certain machines, thus I've defined the following >rules: > >$IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.30 -j ACCEPT >$IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.37 -j ACCEPT >$IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.64 -j ACCEPT >$IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 192.168.1.3 -j ACCEPT >$IPTABLES -A OUTPUT -o $INTIF -d 192.168.1.8 -s 0/0 -j DROP > > >but it is not working, and I can connect from other machine trhu 192.168.1.8. >In the OUTPUT chain packets should be already be natted, thus my doubt is >that the destination address is the final one (e.g., 192.168.4.100) and not >the router one. Is there a way to lock the traffic to the router using >iptables? > >Thanks, >Luca > >