Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenWrt 10.03 router [ IP: ], and it has a DHCP server pool: - clients are using it through wireless/wired connection. Ok!

Here's the catch: I need to separate the users from each other.

How i need to do it: by IPTABLES rule [ /etc/firewall.user ].
"Loud thinking": So i need a rule something like this [on the OpenWrt router]:


The idea is this. Ok!

- Will i lock out myself if i apply this firewall rule?
- Is this a secure method? [ is it easy to do this?: hello, i'm a client, and i say, my IP address is! - now it can sniff the unencrypted traffic! :( - because all the clients are in the same subnet! ]
- Are there any good methods to find/audit for duplicated IP addresses?
- Are the any good methods to find/audit for duplicated MAC addresses?
- Are there any good methods to do this IPTALBES rule on Layer2?:
$ wget -q "http://downloads.openwrt.org/backfire/10.03/ar71xx/packages/" -O - | grep -i ebtables $

p.s.: The rule would be [is it on a good chain?]: iptables -A FORWARD -m iprange --src-range --dst-range -j DROP
Thank you!

share|improve this question
Please don't cross-post and here‌​. – Dennis Williamson Mar 5 '11 at 9:14
up vote 2 down vote accepted

If you want to separate wireless and wired users why not match the interfaces? Assuming ppp0 is facing the internet, eth0 is your local LAN and wlan0 is the wireless:

iptables -P FORWARD DROP                                 # Drop everything except:
iptables -A FORWARD -m state --state RELATED,ESTABLISHED # Accept already accepted connections
iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT            # Accept outgoing connections from local LAN
iptables -A FORWARD -i wlan0 -o ppp0 -j ACCEPT           # Accept outgonig connnections from wlan

If you use this:

  • nothing can be connected from the internet
  • wireless users can only connect to the internet
  • wired users can only connect to the internet
  • you can enforce separate IP ranges if you add the --src-range

If your DHCP server is running on the OpenWrt device then the FORWARD chain will not affect that in any way. To allow the DHCP server use

iptables -P INPUT DROP                                   # Drop everything except:
iptables -A INPUT -m state --state RELATED,ESTABLISHED   # Accept already accepted connections
iptables -A INPUT ! -i ppp0 -p tcp --dport 22 -j ACCEPT  # Don't forget SSH
iptables -A INPUT ! -i ppp0 -p udp --sport 68 --dport 67 # Accept DHCP requests from any local network

I generally allow everything in OUTPUT except a few types of ICMP and spam. But you might prefer the safer default DROP so here is the specific rule:

iptables -P OUTPUT DROP                                             # Drop everything except:
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT ! -o ppp0 -p udp --sport 67 --dport 68 -j ACCEPT # Allow DHCP to the local network

It makes more sense on a router which is not supposed to connect to everything.

I would advise against MAC filtering in my experience it adds no security only inconvinience. But if you want to see:

iptables -m mac --help

Logging MAC addresses could be useful but they are easily forged. Just add -j LOG or -j NFLOG before the ACCEPT rule with the same matching rules.

Since you are configuring a computer which is only accessible from the network you should be very careful not to lock yourself out. You can't just walk to it and delete the rules manually. In particular typing iptables -P INPUT DROP with an empty INPUT chain will kill your SSH session. I recommend using the iptables-save and iptables-restore and writing the rules in a config file. It also helps if you can test the rules on a computer with a keyboard and monitor before trying it on the router.

share|improve this answer
i want to separate the users form each other – LanceBaynes Mar 5 '11 at 10:00
@user4724: So wireless user A shouldn't talk to wireless user B? That connection will not go through the router. WPA can do "wireless client separation". I have no idea how to do that on wired networks. – stribika Mar 5 '11 at 10:05
@user4724: You could do it in the client firewalls. Drop everything from except from the router in the input and output chains. If that's acceptable I will add it to my answer. – stribika Mar 5 '11 at 10:16
thank you! but the main problem is: "it can sniff the unencrypted traffic" - so if a client comes that's e.g.: a mobile device, that will don't have a firewall :\ – LanceBaynes Mar 5 '11 at 10:35
"So wireless user A shouldn't talk to wireless user B? That connection will not go through the router." - Really? it cannot be done with the firewall on the OpenWrt router?? :(( – LanceBaynes Mar 5 '11 at 10:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.