Re: Problems with a forward rule

[Tom van Leeuwen <tom.van.leeuwen@saasplaza.com>]

Indeed do iptables-save for the complete ruleset and tell us what you 
want and expect.

On 12-5-2012 17:47, Jan Engelhardt wrote:
> On Friday 2012-05-11 17:04, C. L. Martinez wrote:
>
>> Hi all,
>>
>> I have setup the following rules in a centos6 gateway:
>> [ugly iptables -L]
> *Use* iptables-save and provide a *full* ruleset.
>
>> All works ok, except when I try to restrict one host to go out via
>> external interface. My problem is with the following rule:
>>
>>    0     0 ACCEPT     all  --  *      *       172.24.50.3
>> 0.0.0.0/0           state NEW
>>
>> If I try to restrict destination, doesn't works. For example using this rule:
>>
>> iptables -A FORWARD -s 172.24.50.3 -d 1.1.1.0/24 -m state --state NEW -j ACCEPT
>>
>> only works if I do:
>>
>> iptables -A FORWARD -s 172.24.50.3 -m state --state NEW -j ACCEPT
>>
>> then, what am I doing wrong??
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html