0

I have one problem which I cannot resolve as I frankly don't know how, I haven't used iptables quite often....

I have one main linux router which is representing gateway for the internet access and which is passing traffic from (WAN IP) 123.123.123.0/30 -> to 234.234.234.0/23 (internal) network. Inside that internal network 234.234.234.0 there is another linux router which is having 3 interfaces. For clarification lets say: 234.234.234.254/23 eth0, 192.168.1.1/24 eth1, and 172.16.0.1/24 eth2. So the schematic would look like:

WAN:123.123.123.2 (eth0) -> (eth1) LAN:234.234.234.1/23 // (eth2) LAN:234.234.234.2 -> (eth0) LAN:192.168.0.1/24 and (eth1) LAN:172.16.0.1/24

Obviously, only route that is needed to be set is default route on main router 0.0.0.0 0.0.0.0 via 123.123.123.1/30 (interface which is ISP gateway)

I have set SNAT from both eth0 and eth1 or should I say (192.168.1.0/24 and 172.16.0.0/24) to go out via 234.234.234.254/23 eth2

Example:

iptables -t nat -I POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source 234.234.234.2

Now all traffic from both private networks are going out via 234.234.234.254 and that is fine. I have internet access which I wanted, but problem is that from private networks I can also reach 234.234.234.0/23 network, which I don't want. I would like to isolate whole traffic to go outside only, but not be able to reach any of machines in network 234.234.234.0/23

How can I achieve that?

What rules are missing to limit traffic to go out, or should I say to allow "internet" access only, but not the "intranet" (of the network 234.234.234.0/23)...?

Improve this question

1 Answer 1

Reset to default
2

Packets are evaluated against rules in filter/FORWARD before nat/POSTROUTING as seen in this Netfilter schematic, so FORWARD can still see unmodified source IP addresses. There is thus no complication or special settings to consider, not even NAT. The firewall rules to add on the second router are simply:

iptables -A FORWARD -s 192.168.1.0/24 -d 234.234.234.0/23 -j REJECT
iptables -A FORWARD -s 172.16.0.0/24 -d 234.234.234.0/23 -j REJECT

There are probably many variations to consider, which are possible here. E.g. you can replace -s 192.168.1.0/24 with -i eth0 and -s 172.16.0.0/24 with -i eth1.

The reverse direction happens to be "protected" by NAT. You should anyway add more rules to enforce it (and protect private networks from the internal network), but then you'd better consider a real set of stateful rules anyway, which can track opened flows, and would then simplify the case where you'd wish to grant some exceptions between private networks and internal network for some sources or destinations. Please check further various examples using stateful firewalling, or simply search for "stateful iptables" (note that in those examples the state module is now superseded by the conntrack module).

Improve this answer
1
  • Thnx man. In regards to your answer: Yes, I know that FORWARD is done before POSTROUTING chain (at least I saw it from graphics while Google-ing about iptables), but for some stupid reason I have set forward rule for 192.168.1.0/24 (internal network) to destination 234.234.234.0/23 to ALLOW instead of REJECT or DROP and set chain by default to DROP. Not sure where I got that bright idea... :D Anyway, thanks man. cheers
    – dovla110010101
    Commented Jan 25, 2019 at 6:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .