1

How to isolate one computer in network

IP to isolation: 10.17.15.99

Subnet: 10.17.15.0

Gateway: 10.15.15.1

Tried:

iptables -I INPUT -s 10.17.15.99 -d 10.17.0.0/24 -j DROP

I need to:

  • Access to internet from the .99 IP
  • Access to from subnet to it
  • Drop all connections to subnet from the IP
0

If you want to allow traffic from the subnet 10.17.0.0/24 to 10.17.15.99, but not allow traffic the other way, this gets a little tricky. The problem is when 10.17.15.99 responds to traffic from 10.17.0.0/24, it needs to be allowed.

You can solve this conundrum with iptables state tracking. The idea is to block new connections outbound from the box, but allow them inbound. To start with, some recommended reading is: http://www.iptables.info/en/connection-state.html#USERLANDSTATES

Thus this one rule should handle it:

iptables -A FORWARD -s 10.17.15.99 -d 10.17.0.0/24 -m state --state NEW -j DROP

Note that the above rule is meant to be placed on the gateway/router which handles traffic for that 10.17.15.99 box. The only other option is to put the filter on the box itself, in which case you should change the FORWARD to OUTPUT.

Note that the state module has support for UDP as well, so it should work there too, and not just TCP.

0

Your iptables ... DROP-rule looks good, except that the subnet you've specified is not the one you want to block access to?

If you want more detailed help, you should describe your network better.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.