If you want to allow traffic from the subnet
10.17.15.99, but not allow traffic the other way, this gets a little tricky. The problem is when
10.17.15.99 responds to traffic from
10.17.0.0/24, it needs to be allowed.
You can solve this conundrum with iptables state tracking. The idea is to block new connections outbound from the box, but allow them inbound. To start with, some recommended reading is: http://www.iptables.info/en/connection-state.html#USERLANDSTATES
Thus this one rule should handle it:
iptables -A FORWARD -s 10.17.15.99 -d 10.17.0.0/24 -m state --state NEW -j DROP
Note that the above rule is meant to be placed on the gateway/router which handles traffic for that
10.17.15.99 box. The only other option is to put the filter on the box itself, in which case you should change the
Note that the
state module has support for UDP as well, so it should work there too, and not just TCP.