Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to isolate a host on my home intranet using iptables on my linux router. So say for instance, I have a host that has the IP of 10.0.1.50 and I want it to be able to talk to the rest of the Internet, but I don't want the router to allow it to talk to any other host in 10.0.1.0/24. However, I want to be able to allow hosts in 10.0.1.0/24 to connect to 10.0.1.50 on port 80 only as long as the connection isn't created on the host. I am doing this in case 10.0.1.50 is compromised, so it can't talk to the rest of my network.

share|improve this question
    
it's related to your interfaces.please edit and explain more. –  Mohsen Pahlevanzadeh Sep 19 '13 at 18:35
    
I am not sure what other information you are looking for. I have two interfaces on the router, a wan and lan. iptables is already setup as a NAT as well. –  sparticvs Sep 19 '13 at 18:43
    
I read again , you don't ban in layer 4, you should do it in layer 3, you shoud ban in switch. –  Mohsen Pahlevanzadeh Sep 19 '13 at 18:49
    
Because before your iptables hosts able to watch together. –  Mohsen Pahlevanzadeh Sep 19 '13 at 18:50

2 Answers 2

up vote 2 down vote accepted

You're most probably doing it wrong. Your router can't prevent 10.0.1.50 from talking to the rest of the 10.0.1.0/24 subnet, because they're in the same subnet. A packet from 10.0.1.50 to another host in this subnet will not pass through the router, so you can't filter it.

What you need to do is to set up a separate subnet, let's say for example 192.168.0.0/24 and put 10.0.1.50 into that subnet, for example with the new IP 192.168.0.50. Then connect this subnet to a separate interface of your router, and configure this interface to an IP like 192.168.0.1. Then you can set up your routing rules as desired:

  • Allow established and related connections
  • Allow 10.0.1.0/24 to connect to the Internet
  • Allow 192.168.0.0/24 to connect to the Internet
  • Allow connections from 10.0.1.0/24 to 192.168.0.50:80
  • Deny everything else
share|improve this answer
    
So I did that originally, so I am glad that that was the right path to take. Originally, I had it so that the host was in 10.0.2.0/24 and my regular subnet was 10.0.1.0/24. I added 10.0.2.1 to eth1 on my router, which also was 10.0.1.1. However, I had a routing issue between the two networks, which didn't make sense to me. Thoughts? –  sparticvs Sep 19 '13 at 19:59
    
"Your router can't prevent 10.0.1.50 from talking to the rest of the 10.0.1.0/24 subnet, because they're in the same subnet" - if the computers on the network are directly connected to the router, it should be possible to drop undesired packets even on the usually bridged LAN, shouldn't it? –  peterph Sep 19 '13 at 20:04
    
@peterph I think you would have to connect each computer to a separate interface on the router and then you would have to set up a /31 or /30 mini subnet for each computer, which of course doesn't seem very practical. As soon as multiple computers are directly connected via hub/switch/bridge the packets between these computers would no longer pass through the router. –  Martin von Wittich Sep 19 '13 at 20:13
    
@sparticvs please try to restore this configuration then [or: wait for other answers in case I'm wrong] and then edit your posting to reflect it. Explain the issues you're having and then we can take it from there. –  Martin von Wittich Sep 19 '13 at 20:14
1  
@peterph wow, you've got me there... I had never heard of ebtables before now :). Yes, that could work in the right circumstances, but unless you really need the ability to selectively pass or filter Ethernet frames, it's probably the wrong tool for the job. –  Martin von Wittich Sep 19 '13 at 20:49

To do it you should ban in layer 3 not layer 4, or if you do in layer 4, you should define a new subnet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.