2

I have a server running as a gateway with three interfaces on their own networks:

  • enp1s0 - DHCP to Internet
  • enp2s0 - 172.16.0.1/12 to work LAN
  • enp3s0 - 10.0.0.1/8 for guest wireless

I want both enp2s0 and enp3s0 to access enp1s0 (internet) and I want to block enp3s0 (wireless) reaching anything in enp2s0. Is there a way to do this with firewalld? If not, with iptables?

Would this work?

iptables -I FORWARD -s 10.0.0.0/255.0.0.0 -d 172.16.0.0/255.240.0.0 -j DROP

do I also need?

iptables -A FORWARD -s 10.0.0.0/255.0.0.0 -d 0.0.0/0.0.0.0 -j ACCEPT

For firewalld can I use

--add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 destination address=172.16.0.0/12 drop'

do I also need?

--add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 destination address=0.0.0.0 accept'

With these rules I can still ping a server in 172.16.0.0/12 network from 10.0.0.0/8. I would like nothing visible from the 10.0.0.0/8 network only the enp1s0 internet.

  • 1
    I want to block my wireless segment from reaching anything on my work LAN. – louisg00 Feb 25 at 0:18
1
# sudo iptables -I FORWARD -i ens3s0 -o ens2s0 -j DROP

This means that all traffic coming from ens3s0 destined to ens2s0 will be dropped.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.