Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to isolate a host on my home intranet using iptables on my linux router. So say for instance, I have a host that has the IP of and I want it to be able to talk to the rest of the Internet, but I don't want the router to allow it to talk to any other host in However, I want to be able to allow hosts in to connect to on port 80 only as long as the connection isn't created on the host. I am doing this in case is compromised, so it can't talk to the rest of my network.

share|improve this question
it's related to your interfaces.please edit and explain more. – PersianGulf Sep 19 '13 at 18:35
I am not sure what other information you are looking for. I have two interfaces on the router, a wan and lan. iptables is already setup as a NAT as well. – sparticvs Sep 19 '13 at 18:43
I read again , you don't ban in layer 4, you should do it in layer 3, you shoud ban in switch. – PersianGulf Sep 19 '13 at 18:49
Because before your iptables hosts able to watch together. – PersianGulf Sep 19 '13 at 18:50
up vote 2 down vote accepted

You're most probably doing it wrong. Your router can't prevent from talking to the rest of the subnet, because they're in the same subnet. A packet from to another host in this subnet will not pass through the router, so you can't filter it.

What you need to do is to set up a separate subnet, let's say for example and put into that subnet, for example with the new IP Then connect this subnet to a separate interface of your router, and configure this interface to an IP like Then you can set up your routing rules as desired:

  • Allow established and related connections
  • Allow to connect to the Internet
  • Allow to connect to the Internet
  • Allow connections from to
  • Deny everything else
share|improve this answer
So I did that originally, so I am glad that that was the right path to take. Originally, I had it so that the host was in and my regular subnet was I added to eth1 on my router, which also was However, I had a routing issue between the two networks, which didn't make sense to me. Thoughts? – sparticvs Sep 19 '13 at 19:59
"Your router can't prevent from talking to the rest of the subnet, because they're in the same subnet" - if the computers on the network are directly connected to the router, it should be possible to drop undesired packets even on the usually bridged LAN, shouldn't it? – peterph Sep 19 '13 at 20:04
@peterph I think you would have to connect each computer to a separate interface on the router and then you would have to set up a /31 or /30 mini subnet for each computer, which of course doesn't seem very practical. As soon as multiple computers are directly connected via hub/switch/bridge the packets between these computers would no longer pass through the router. – Martin von Wittich Sep 19 '13 at 20:13
@sparticvs please try to restore this configuration then [or: wait for other answers in case I'm wrong] and then edit your posting to reflect it. Explain the issues you're having and then we can take it from there. – Martin von Wittich Sep 19 '13 at 20:14
@peterph wow, you've got me there... I had never heard of ebtables before now :). Yes, that could work in the right circumstances, but unless you really need the ability to selectively pass or filter Ethernet frames, it's probably the wrong tool for the job. – Martin von Wittich Sep 19 '13 at 20:49

To do it you should ban in layer 3 not layer 4, or if you do in layer 4, you should define a new subnet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.