I have one problem which I cannot resolve as I frankly don't know how, I haven't used iptables quite often....

I have one main linux router which is representing gateway for the internet access and which is passing traffic from (WAN IP) -> to (internal) network. Inside that internal network there is another linux router which is having 3 interfaces. For clarification lets say: eth0, eth1, and eth2. So the schematic would look like:

WAN: (eth0) -> (eth1) LAN: // (eth2) LAN: -> (eth0) LAN: and (eth1) LAN:

Obviously, only route that is needed to be set is default route on main router via (interface which is ISP gateway)

I have set SNAT from both eth0 and eth1 or should I say ( and to go out via eth2


iptables -t nat -I POSTROUTING -s -j SNAT --to-source

Now all traffic from both private networks are going out via and that is fine. I have internet access which I wanted, but problem is that from private networks I can also reach network, which I don't want. I would like to isolate whole traffic to go outside only, but not be able to reach any of machines in network

How can I achieve that?

What rules are missing to limit traffic to go out, or should I say to allow "internet" access only, but not the "intranet" (of the network

1 Answer 1


Packets are evaluated against rules in filter/FORWARD before nat/POSTROUTING as seen in this Netfilter schematic, so FORWARD can still see unmodified source IP addresses. There is thus no complication or special settings to consider, not even NAT. The firewall rules to add on the second router are simply:

iptables -A FORWARD -s -d -j REJECT
iptables -A FORWARD -s -d -j REJECT

There are probably many variations to consider, which are possible here. E.g. you can replace -s with -i eth0 and -s with -i eth1.

The reverse direction happens to be "protected" by NAT. You should anyway add more rules to enforce it (and protect private networks from the internal network), but then you'd better consider a real set of stateful rules anyway, which can track opened flows, and would then simplify the case where you'd wish to grant some exceptions between private networks and internal network for some sources or destinations. Please check further various examples using stateful firewalling, or simply search for "stateful iptables" (note that in those examples the state module is now superseded by the conntrack module).

  • Thnx man. In regards to your answer: Yes, I know that FORWARD is done before POSTROUTING chain (at least I saw it from graphics while Google-ing about iptables), but for some stupid reason I have set forward rule for (internal network) to destination to ALLOW instead of REJECT or DROP and set chain by default to DROP. Not sure where I got that bright idea... :D Anyway, thanks man. cheers Jan 25, 2019 at 6:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .