I have one router with 3 networkcards (one goes global and two are intern) and I would like to know if i enabled in the router nat.ipv4.ip_forward = 1 so does a host on subnet 1 cann reach a host on subnet 2 ?

If so how can I disable both subnetwork from seeing each other but still reaching global internet.

I'm using Linux.



That's net.ipv4.ip_forward=1, usually in /etc/sysctl.conf, and enabling it will allow the router to route from any network to any other unless there are restrictions in place.

The simplest way to achieve the restrictions you want would be using iptables FORWARD rules.

For example, if the network interface for subnet 1 is eno1 and for subnet 2 eno2 respectively, you might add these two iptables rules in the very beginning of the FORWARD ruleset:

iptables -I FORWARD 1 -i eno1 -o eno2 -j DROP
iptables -I FORWARD 2 -i eno2 -o eno1 -j DROP


  • rule #1 for forwarding packets: if the packet came in eno1 and would be going out via eno2, DROP it.
  • rule #2 for forwarding packets: if the packet came in eno2 and would be going out via eno1, DROP it.

Since you did not specify the Linux distribution you're using in the router, the problem of integrating these basic-form iptables rules to any higher-level firewall management tool you might have (firewalld, ufw, many others) must be left as an exercise for the reader.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.