I have one problem which I cannot resolve as I frankly don't know how, I haven't used iptables quite often....
I have one main linux router which is representing gateway for the internet access and which is passing traffic from (WAN IP) 126.96.36.199/30 -> to 188.8.131.52/23 (internal) network. Inside that internal network 184.108.40.206 there is another linux router which is having 3 interfaces. For clarification lets say: 220.127.116.11/23 eth0, 192.168.1.1/24 eth1, and 172.16.0.1/24 eth2. So the schematic would look like:
WAN:18.104.22.168 (eth0) -> (eth1) LAN:22.214.171.124/23 // (eth2) LAN:126.96.36.199 -> (eth0) LAN:192.168.0.1/24 and (eth1) LAN:172.16.0.1/24
Obviously, only route that is needed to be set is default route on main router 0.0.0.0 0.0.0.0 via 188.8.131.52/30 (interface which is ISP gateway)
I have set SNAT from both eth0 and eth1 or should I say (192.168.1.0/24 and 172.16.0.0/24) to go out via 184.108.40.206/23 eth2
iptables -t nat -I POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source 220.127.116.11
Now all traffic from both private networks are going out via 18.104.22.168 and that is fine. I have internet access which I wanted, but problem is that from private networks I can also reach 22.214.171.124/23 network, which I don't want. I would like to isolate whole traffic to go outside only, but not be able to reach any of machines in network 126.96.36.199/23
How can I achieve that?
What rules are missing to limit traffic to go out, or should I say to allow "internet" access only, but not the "intranet" (of the network 188.8.131.52/23)...?