4

I currently have ipv4.ip_forward enabled to route packets between multiple interfaces.

I am now scaling up the system to 8 interfaces, but I want to limit the routing between interfaces/addresses.

One option is to use the firewalld, but I'm deploying this on an older version of RH so it would be done via iptables.

  • 1
    seems like iptables -I FORWARD -i eth0 -o eth1 -j DROP might drop all eth0 packets bound for eth1, thereby separating them in that direction. And a mirrored rule in the opposite direction might fully separate them. But I am in no position to test, and I've never tried to do such a thing. – infixed Jun 13 '16 at 22:39
  • this problem could be related: askubuntu.com/questions/1162147/… – Stefano Scoppa Jul 31 '19 at 11:53
3

Actually iptables is suited very well to restrict this. The filter table, where packets are allowed or blocked has three chains. In each chain rules can be defined to match packets and trigger an action if a packet is matched. Against which chain of rules a packet is matched depends on the direction of the packet relative to the host where iptables is running:

  • INPUT: Incoming packet destined for the local host
  • OUTPUT: Outgoing packets originating from the local host
  • FORWARD: Packets destined for another host and need to be forwarded

Now for example if a packet is to be forwarded and has no rule that matches it in the FORWARD chain, it will be handled according to the policy set on this chain, which is by default: ACCEPT. The packet will be allowed to pass. This command will show the policies and rules if any of them are defined:

iptables -t filter -vnL

The table is specified using -t <table>, filter is the default table if none is specified, so the following command is equivalent:

iptables -vnL

To block all packets for forwarding, the policy on this chain can be set to REJECT or DROP as follows

iptables -P FORWARD REJECT

Now all packets which are to be forwarded are rejected if no rule in the FORWARD chain explicitly accepts them.

For internal traffic, you likely want a REJECT policy. This will notify clients immediately that the path is closed. You may want DROP rules for traffic originating from an external network.

To explicitly allow certain packets to pass, rules are appended to those chains, which are matched aigainst packets in the order those rules were defined. For example to allow all traffic coming in on eth0 and based on the routing to be forwarded to eth1:

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

And for example to only allow packets from the 10.0.0.0/24 subnet to pass in the opposite direction:

iptables -A FORWARD -i eth1 -o eth0 -s 10.0.0.0/24 -j ACCEPT

For a detailed description of all the parameters refer to the iptables manpage and the iptables-extensions manpage.

  • 2
    For internal traffic, you likely want a REJECT policy. This will notify clients immediately that the path is closed. You may want DROP rules for traffic originating from the network. – BillThor Jun 14 '16 at 0:31
  • This is an excellent answer, and helped me solve my problem of isolating VPN users perfectly. Thanks a lot. – deed02392 Jun 17 '17 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.