net.ipv4.ip_forward=1, usually in
/etc/sysctl.conf, and enabling it will allow the router to route from any network to any other unless there are restrictions in place.
The simplest way to achieve the restrictions you want would be using
iptables FORWARD rules.
For example, if the network interface for subnet 1 is
eno1 and for subnet 2
eno2 respectively, you might add these two iptables rules in the very beginning of the FORWARD ruleset:
iptables -I FORWARD 1 -i eno1 -o eno2 -j DROP
iptables -I FORWARD 2 -i eno2 -o eno1 -j DROP
- rule #1 for forwarding packets: if the packet came in
eno1 and would be going out via
eno2, DROP it.
- rule #2 for forwarding packets: if the packet came in
eno2 and would be going out via
eno1, DROP it.
Since you did not specify the Linux distribution you're using in the router, the problem of integrating these basic-form
iptables rules to any higher-level firewall management tool you might have (
ufw, many others) must be left as an exercise for the reader.